Recredentialing and revalidation calendar

If you own an OT, PT or SLP practice treating children, adults or both, give every enrollment, credential and record its own row and clock. Medicare requires revalidation every 5 years, Medicaid at least every 5, Medicare Advantage plans recredential at least every 3, and Medicare and NPI changes carry 30- and 90-day deadlines.⁠^1,2,3,4,5

Credentialing gets a practice into a network; this guide covers staying there, record by record, and the credentialing guide covers the first applications.

What does a therapy practice have to keep current after credentialing?

Every enrollment, contract, credential and identifier the practice relied on to get in network, each on its own clock, because updating one record does not update another. CMS makes the point about two of them: Medicare enrollment requires an NPI, but a change made in NPPES does not carry over to the Medicare enrollment record on its own.⁠¹⁰

Start with an inventory of each clinician, the business entity, each location and each payer relationship, and the clock each runs on; a commercial plan’s cycle and a board’s renewal month come from the plan and the board.

Which rows a practice carries depends on whom it sees. A practice enrolled in Medicare carries the Medicare rows whether it sees one Medicare patient a month or fifty; a pediatric practice that serves families through Medicaid carries a state row and one row per managed care plan; a practice that sees children and adults carries both sets.

Keep the OT, PT and SLP rows apart even inside one practice. Medicare puts OTs and SLPs in its limited-risk screening category and PTs, whether enrolling alone or as a group, in the moderate one, and that screening runs again on revalidation applications and on applications to add a practice location.⁠¹⁹

How often does a therapy practice revalidate its Medicare enrollment?

Every 5 years, on a date CMS sets, plus any off-cycle revalidation CMS asks for. Billing privileges last only while a provider or supplier resubmits and recertifies its enrollment record every 5 years; CMS reaches out to each one directly when the time comes, expects the application within 60 calendar days of that notice, and reserves the right to request revalidation off cycle.⁠¹

CMS’s revalidation page sets out how the dates reach you. Due dates are posted seven months ahead on the Medicare Revalidation List, the enrollment contractor sends a notice by email or postal mail three or four months ahead of the due date, and CMS grants no extensions and no exemptions; the same page says you are responsible for tracking the date even though notices go out.⁠⁶ CMS’s manual for its contractors puts the notice at 90 to 105 days before the due date, and lets a contractor accept an extension request only from a provider that was not given the full 7 months’ advance notice.⁠⁸

The look-up tool fills in the rest. CMS sets every due date at the end of a month and posts it six to seven months in advance, a due date shown as TBD has not been set yet, and the tool states when its data was last refreshed and when the next refresh is due, so check it after each refresh.⁠²⁰

Two rules on CMS’s page set the window: revalidate once you are within three months of the due date even without a notice, and do not revalidate more than seven months ahead unless you have a notice, because those unsolicited applications are returned.⁠⁶ Enter the due date, the day the notice arrived and the 60-day response date in the register as three separate dates.⁠¹

Do the group and each therapist have separate Medicare due dates?

Yes, so give each its own row. The Medicare Revalidation List finds due dates for individual and organizational providers, and its data includes due-date listings for clinics and group practices and their providers, with each provider’s reassignments.⁠^6,20 A practice with four clinicians who reassign to the group can therefore have five Medicare due dates in one five-year cycle, and they need not fall in the same month.

The individual rows matter to the group. A reassignment is what lets the group submit claims and receive payment for the Part B services a clinician provides as its member.⁠²¹ When a supplier fails to respond to a revalidation request, CMS’s manual tells the contractor to end-date all of that supplier’s reassignments, including any newly established one.⁠⁸

Does a PT practice get a site visit at Medicare revalidation?

Yes, when it is a private practice physical therapist or PT group. CMS’s manual tells the contractor to order a site visit when a private practice physical therapist or physical therapist group submits a revalidation application, and again when it adds a location or moves one, while an OT group in private practice with no physical therapist in it is handled under limited screening and needs no visit.⁠⁸ That follows the federal screening levels, which place OTs and SLPs at limited risk and PTs at moderate risk.⁠¹⁹

One physical therapist is enough to change that: an occupational therapy group in private practice that includes one is screened at the moderate level, with a site visit.⁠⁸ Prepare for the visit as for the first one. The enrollment rules define an operational practice as one with a qualified physical practice location, open to the public to provide health care services, prepared to submit valid Medicare claims, and properly staffed, equipped and stocked.⁠²²

What happens when a Medicare revalidation deadline is missed?

Claims can stop first, and if the application still does not arrive, billing privileges are deactivated back to the day after the deadline.⁠⁸ CMS’s page warns that a late revalidation could bring a hold on Medicare reimbursement or deactivation, that reactivating takes a complete Medicare enrollment application, and that Medicare does not reimburse services during the period of deactivation.⁠⁶

The hold is a stay of enrollment. CMS may stay an enrollment for up to 60 days when a provider is out of compliance with an enrollment requirement; the provider stays enrolled, but claims with dates of service in the stay are rejected unless compliance is restored and the stay ends within the period set, in which case they become eligible for payment and can be resubmitted.⁠⁷

CMS’s manual walks through a missed revalidation whose last day is February 27. The stay starts February 28 and gives the provider until March 29 to file; if the application arrives on March 16, claims for February 28 through March 16 are payable, and if it has not arrived by March 29, the enrollment is deactivated effective February 28.⁠⁸ Separately, the regulation lets CMS deactivate a provider that has not furnished complete information within 90 calendar days of being notified to revalidate.⁠⁹

Reactivation does not reach back. A deactivated supplier recertifies its enrollment information, or submits a complete CMS-855 application when CMS requires one, and the reactivation takes effect on the date the contractor received the submission it approved; nothing is paid for services furnished while deactivated.⁠⁹ CMS’s manual adds that the contractor may not add a retroactive back-billing period, such as 30 days, to that date, that a reactivated Part B supplier receives a new PTAN, and that a moderate-risk supplier, which includes a physical therapist, gets a site visit before the decision; reactivations are held to the processing standards for initial applications.⁠^8,19

The patient does not pay for the gap either. No Medicare payment may be made while billing privileges are deactivated, the beneficiary has no financial responsibility for those services, and any amount collected from the beneficiary must be refunded.⁠²³

What else can deactivate a therapist’s Medicare billing privileges?

Missing a change report, a long stretch without claims, and losing the location, reassignment or license the enrollment rests on. The regulation allows deactivation when a provider submits no Medicare claims for 6 consecutive calendar months, does not report a change within the required time, has a non-operational practice location, or is voluntarily withdrawing.⁠⁹ CMS’s manual tells contractors to deactivate a supplier enrolled with neither an active reassignment nor a practice location for 90 days or longer, and one whose license has expired if it has not billed while the license was expired; deactivations for not billing are made only at CMS’s explicit direction.⁠⁸

The 6-month rule matters most to a practice that keeps a Medicare enrollment for a small adult caseload, such as a pediatric clinic that also sees a few adults.⁠⁹ Record the date of the last Medicare claim on each enrollment in the register, so a quiet stretch is noticed while there is still time to decide what to do about it.

Which changes must a practice report to Medicare, and by when?

A change of ownership, any adverse legal action, and adding, changing or removing a practice location within 30 days; every other change in enrollment within 90 days.⁠⁴ The paragraph for all other providers and suppliers uses the same two windows and adds changes in authorized or delegated officials to the 30-day list, so a practice that reports an official’s change within 30 days meets either reading.⁠⁴ CMS’s enrollment page gives the same 30- and 90-day split as the way to avoid revocation, and says online enrollees update in PECOS while paper enrollees resubmit the form.⁠²⁴

Late reporting has two consequences in the rules. CMS may revoke billing privileges for failing to report, weighing whether the data was reported, how belatedly, and how material it was.⁠²⁵ It may also deactivate, with the deactivation dated from the day the practice fell out of compliance: CMS’s manual gives the example of a new 10 percent owner on May 1, a report due by May 31, and a deactivation effective June 1.⁠^8,9 The same manual tells contractors to process a change reported after 90 days without deactivating when there was no earlier administrative action and no revocation applies, which is a reason to file a late change at once rather than hold it for the next revalidation.⁠⁸

Treat a licensing board’s action as a 30-day Medicare report. The enrollment rules list a state licensing authority’s suspension or revocation of a license, and an exclusion from a federal or state health care program, among final adverse actions, and the reporting rule gives any adverse legal action 30 days.⁠^4,22

Changes to the group’s record are made by its authorized official, the person holding the organization’s legal authority over its Medicare enrollment and status, or by a delegated official, who must hold an ownership or control interest or be a W-2 managing employee.⁠²² Name both in the register.

What has to change when a therapist joins or leaves the practice?

Their Medicare reassignment, each plan’s roster and directory entry, and their own records, from the day they start or finish. The CMS-855R is now part of the CMS-855I, so reassignments are added, changed or terminated on the 855I or in the Reassignment topic in PECOS, and a termination is signed by the practitioner or by the group’s authorized or delegated official.⁠²¹

When a clinician leaves, PECOS walks through ending a reassignment, ending employment with an organization and ending a practice location, and a clinician who retires, surrenders a license or stops participating must withdraw within 90 days.⁠²⁶ A clinician left with no active reassignment and no practice location for 90 days or longer is deactivated under CMS’s manual, so record who files the termination and keep the confirmation.⁠⁸ A clinician’s name is part of the directory information a practice sends a commercial plan when that information materially changes.⁠¹⁵

A new clinician needs the opposite: a reassignment to the group, a DataSpring profile with the right plans authorized, and an application to each plan whose network the clinician joins, before any visit is billed to that plan under their name.⁠^14,21 On DrSensory, which lists clinics rather than individual therapists, a hire changes the listing where it frees capacity, through the Accepting new patients and typical wait answers, and a departure is worth checking against any description that names a therapist.⁠²⁷

How does Medicaid revalidation work for a therapy practice?

Through your state, at least every 5 years, with screening repeated each time. Federal rules require the state Medicaid agency to revalidate all providers, of every type, no less often than every 5 years, and it screens revalidation applications, like initial applications and applications for a new practice location, at the provider’s categorical risk level.⁠^2,28 The state sets its own notice, portal and form, so the register records the day its notice arrived and the due date it gives, not a date counted from the last approval.

Deactivation costs more in Medicaid than a form. Whatever caused a deactivation, the state screens the provider again and collects any application fee that applies before turning the enrollment back on.⁠¹¹ Ask the state’s enrollment line what deactivates an enrollment there, and record the answer. The Medicaid enrollment guide covers screening levels, fees and the provider agreement.

Managed care adds rows. Plan network providers are screened, enrolled and periodically revalidated by the state itself, which also writes one credentialing and recredentialing policy all its plans must follow and can add requirements on top; each plan works to a documented recredentialing process.⁠^12,29 Ask each plan for its recredentialing date and record it beside the state’s revalidation date.

Once a Medicaid plan has your new details, its online directory has 30 calendar days to show them, so send each change in writing and check the entry after the window closes.⁠¹⁸ For pediatric practices, the EPSDT guide covers the children’s side of Medicaid that these enrollments bill.

How often do insurance plans recredential a therapy practice?

On each plan’s own cycle, which federal rules fix for Medicare Advantage and leave to the state for Medicaid managed care. A Medicare Advantage organization must recredential the physicians and other health care professionals it contracts with at least every 3 years, weighing performance indicators such as grievances and appeals and including an attestation that the new information is correct and complete.⁠³ Medicaid managed care plans follow the state’s uniform policy.⁠¹²

Commercial plans set their cycles in their own credentialing policies and contracts. NCQA lists recredentialing cycle length among the areas its Credentialing Accreditation assesses and offers its standards document through its store, so the cycle a given plan uses is a question for that plan.⁠³⁰ Ask each plan in writing for its cycle, the date of your last credentialing decision and how it sends recredentialing requests.

Plans check the directory more often than they recredential. A commercial plan must verify and update each provider’s directory information at least once every 90 days, must have a procedure for removing a provider it cannot verify, and must post a provider’s update to its database no later than 2 business days after receiving it.⁠¹⁶ The practice’s side is to send directory information when a network agreement begins or ends, when the information materially changes, and when the plan asks; it covers the names, addresses, specialty, phone numbers and digital contact information of individual clinicians and of the clinic.⁠¹⁵ Answer each verification request the week it arrives and file the reply with the plan’s row.

How often should a therapist re-attest a CAQH profile?

On DataSpring’s 120-day attestation cycle, with the profile reviewed every quarter. DataSpring, as CAQH is now called, describes clinician profiles as maintained on a 120-day attestation cycle, and its fact sheet advises updating the profile quarterly to reduce telephone and email requests from plans.⁠^13,14 The steps it lists are to complete the profile and upload documents, attest that the information is truthful and complete, and authorize the plans that may see it; using the portal is voluntary, yet DataSpring counts more than 1,000 plans and other healthcare organizations that ask their networks to use it for credentialing.⁠³¹

Plans rely on that attestation being current. Aetna retrieves the credentialing application from CAQH ProView and asks the clinician to designate Aetna as an authorized plan, and UnitedHealthcare, which asks for DataSpring only for some states and specialties, wants attestations and documents current wherever it does.⁠^32,33 Staff can be delegated to manage non-sensitive information, while the attestation step is the clinician’s, so the calendar names the clinician as the person who attests and a staff member as the one who sends the reminder.⁠^14,31

Which licenses, identifiers and documents belong on the calendar?

Each clinician’s license, the practice’s NPIs and EIN records, its liability policy, its entity filings and its exclusion checks, because every enrollment rests on them. Medicare enrollment requires continuing compliance with federal and state licensure requirements, and CMS’s manual tells contractors to deactivate a supplier whose license has expired and who has not billed while it was expired.⁠^4,8

Licenses. Each board sets its own renewal cycle and requirements, so the register lists each clinician’s licensing board, license number, renewal month and the date the renewed license reached each plan and the DataSpring profile. A clinician licensed in two states has two rows, and an assistant’s license, where the state issues one, belongs there too.

Identifiers. The HIPAA rule on NPIs gives a covered health care provider 30 days to report a change in its required NPPES data; each individual is eligible for one Type 1 NPI, and an organization can hold more than one Type 2 NPI, so list every NPI the practice and its clinicians use.⁠^5,10 Changes to the business’s mailing address, location or responsible party go to the IRS on Form 8822-B, and a change in the responsible party must be reported within 60 days.⁠¹⁷

Tax-ID proof. Keep the IRS notice that assigned the EIN, because the original CP575A-J notice cannot be duplicated or recreated.⁠³⁴ When a plan asks for proof of the EIN and the original is gone, the IRS lists three ways to confirm it: an entity transcript, a digital CP575 downloaded in Business Tax Account, which can substitute for the original notice and for Letter 147C, or a Letter 147C requested from its business and specialty tax line.⁠³⁵ The IRS says banks and other institutions accept the digital CP575 as written confirmation of an EIN; ask a plan which form it takes.⁠³⁴

Insurance and entity papers. A liability policy renewal is two tasks: the renewal itself, and replacing the old certificate wherever a copy is held, including the DataSpring profile, where clinicians upload their documentation.⁠¹⁴ The entity’s filings with the state where it is organized run on that state’s schedule; give them a row with the state’s due date.

Exclusion checks. Medicare enrollment requires that a practice not employ or contract with anyone excluded from federal health care programs, and OIG tells health care entities to check new hires and current employees against its exclusion list routinely; OIG publishes monthly supplement files of what was added or removed, which is why the calendar below checks monthly.⁠^4,36

What goes in a credentialing maintenance register?

One row per requirement, each with its source, its legal due date, an earlier preparation date, an owner, a reviewer and the proof that it was done. Every row answers the same five questions: what the record is, when it is due and by whose rule, who prepares and who checks it, what proves it was submitted, and what event would reset it.

Status changes only with a document. Mark a row submitted when the confirmation arrives and confirmed when the program or plan says so in writing, and keep the receipt after approval; a phone call changes nothing until its letter or portal message arrives, so note the caller and the words used. The status labels from the credentialing guide fit this register as well, and if a vendor keeps some of these rows, the guide to paying for a credentialing service covers what its contract should say about upkeep.

Why keep the preparation date apart from the legal deadline?

Because they answer different questions, and mixing them makes a practice either too early to be accepted or too late to stay active. Medicare shows both risks: an unsolicited revalidation sent more than seven months before the due date is returned, while a provider within three months of the date should revalidate even without a notice.⁠⁶ Write the legal date exactly as the source gives it, and the preparation date as the practice’s own target inside the window the source allows.

Never type the preparation date into the due-date column: a register that shows only the earlier date hides the real deadline, and one that shows only the legal date leaves no time for a site visit, a missing document or a clinician on leave.

Which events restart a credentialing clock, and who must be told?

Any change to who practices, where, under what name or tax ID, or who owns or signs for the practice. The table lists each event, who hears about it and the deadline its source sets; where no federal deadline exists, look for one in the plan’s contract or the state’s provider manual, and record where it came from.

Run one checklist per event, so a single move or hire produces one record of everything it touched.

What does a month-by-month credentialing calendar include?

Fixed monthly and quarterly checks, plus every dated row from the register in the month it falls due. The recurring anchors come from the sources above: a monthly exclusion check, matching OIG’s monthly supplement files; a quarterly DataSpring profile review, as its fact sheet advises, inside the 120-day attestation cycle; and a look at the Medicare Revalidation List after each data refresh.⁠^13,14,20,36

What does one clinic move look like across every record?

It touches a dozen records on different clocks. The example is hypothetical; its sequence follows the rules cited in this guide, and its dates are inputs chosen for the example.

How do public listings fit into a credentialing calendar?

As rows on the same change checklist, because the address, phone, hours and plans a family reads on a listing change with the same events. The guide to name, address and phone consistency covers keeping the practice’s identity consistent across the website, Google and directories.

Families search DrSensory without charge for OT, PT and speech therapy clinics. Each listing is a clinic at one address, not an individual therapist; the basic listing costs the clinic nothing, and so does claiming it, which takes three steps: finding the listing, confirming an email address by six-digit code, and setting a password.⁠²⁷ With a subscription, the clinic edits its own name, address, phone and hours in the portal and publishes them. The profile shows the change roughly a minute later; the next publish is open seven days after that, and an edit DrSensory makes on its side does not count against the clinic’s week.⁠^27,37

Paid listings carry the clinic’s own description and a Clinic details box listing the insurance boxes it ticks in the portal.⁠^37,38 A ticked box names no plan, so a clinic in network with particular plans says so in its description and changes that sentence the day participation changes. DrSensory does not vouch for clinical quality: the Verified label on a paid listing reflects a subscription and details the practice confirmed itself, not a review of its care.⁠^27,38 The profile guide walks through every field.

Sources

1. 42 CFR. §424.515, Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “To maintain Medicare billing privileges, a provider or supplier (other than a DMEPOS supplier) must resubmit and recertify the accuracy of its enrollment information every 5 years.”; “The provider or supplier then enters a 5-year revalidation cycle once a completed enrollment application is submitted and validated.”; “CMS contacts each provider or supplier directly when it is time to revalidate their enrollment information.”; “A provider or supplier must submit to CMS the applicable enrollment application with complete and accurate information and applicable supporting documentation within 60 calendar days of our notification to resubmit and certify to the accuracy of its enrollment information.”; “CMS reserves the right to perform off cycle revalidations in addition to the regular 5-year revalidations and may request that a provider or supplier recertify the accuracy of the enrollment information when warranted to assess and confirm the validity of the enrollment information maintained by CMS.”.
2. 42 CFR. §455.414, Revalidation of enrollment (Medicaid provider screening and enrollment, part 455, subpart E; eCFR, up to date as of October 22, 2026). “The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.”. Checked October 25, 2026.
3. 42 CFR. §422.204, Provider selection and credentialing (Medicare Advantage; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “An MA organization must follow a documented process with respect to providers and suppliers who have signed contracts or participation agreements that”; “For physicians and other health care professionals, including members of physician groups, covers”; “Recredentialing at least every 3 years that updates information obtained during initial credentialing, considers performance indicators such as those collected through quality improvement programs, utilization management systems, handling of grievances and appeals, enrollee satisfaction surveys, and other plan activities, and that includes an attestation of the correctness and completeness of the new information”.
4. 42 CFR. §424.516, Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “Compliance with Federal and State licensure, certification, and regulatory requirements, as required, based on the type of services or supplies the provider or supplier type will furnish and bill Medicare.”; “Not employing or contracting with individuals or entities that meet either of the following conditions: (i) Excluded from participation in any Federal health care programs”; “Physicians, nonphysician practitioners, and physician and nonphysician practitioner organizations must report the following reportable events to their Medicare contractor within the specified timeframes: (1) Within 30 days— (i) A change of ownership; (ii) Any adverse legal action; or (iii) A change, addition, or deletion of a practice location. (2) All other changes in enrollment must be reported within 90 days.”; “Within 30 days for a change of ownership or control (including changes in authorized official(s) or delegated official(s)), an adverse legal action, or a change, addition, or deletion of a practice location.”; “All other changes to enrollment must be reported within 90 days.”.
5. 45 CFR. §162.410, Implementation specifications: Health care providers (HIPAA administrative requirements, the National Provider Identifier; eCFR, up to date as of October 22, 2026). “A covered entity that is a covered health care provider must:”; “Communicate to the NPS any changes in its required data elements in the NPS within 30 days of the change.”. Checked October 25, 2026.
6. Centers for Medicare & Medicaid Services. Revalidations (Renewing Your Enrollment) (page last modified July 29, 2025). Checked October 25, 2026.
   Show the passageHide the passage

   “In general, providers and suppliers revalidate every five years but DMEPOS suppliers revalidate every three years. CMS also reserves the right to request off-cycle revalidations.”; “You can search the Medicare Revalidation List to find a due date for an individual or organizational provider.”; “CMS posts revalidation due dates seven months in advance.”; “Failing to revalidate on time could result in a hold on your Medicare reimbursement or deactivation of your Medicare billing privileges.”; “If your Medicare billing privileges are deactivated, you’ll need to re-submit a complete Medicare enrollment application to reactivate your billing privileges. Medicare won’t reimburse you for any services during the period that you were deactivated.”; “There are no exemptions from revalidation. Additionally, CMS doesn’t grant extensions”; “Your enrollment contractor will send a revalidation notice to you via email or U.S. postal mail about three to four months prior to your due date.”; “Although revalidation notices are sent ahead of time, you’re responsible for keeping track of your due date.”; “You’re within three months of your revalidation due date, even if you haven’t received a notification.”; “Your due date is more than seven months away unless you’ve received a revalidation notice. These unsolicited revalidations will be returned.”.
7. 42 CFR. §424.541, Stay of enrollment (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “CMS may stay an enrolled provider’s or supplier’s enrollment if the provider or supplier: (i) Is non-compliant with at least one enrollment requirement in this title.”; “The provider or supplier remains enrolled in Medicare;”; “claims submitted by the provider or supplier with dates of service within the stay period will be rejected.”; “claims submitted by the provider or supplier with dates of service within the stay period are eligible for payment (and may be resubmitted by the provider or supplier within applicable timeframes specified in Title 42) if: (1) CMS or its contractor determines that the provider or supplier has resumed compliance with all Medicare enrollment requirements in Title 42; and (2) The stay ends (as described in paragraph (a)(5) of this section) on or before the expiration of the originally designated stay period.”; “CMS may establish a stay of enrollment for any period up to a maximum of 60 days.”.
8. Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 10, Medicare Enrollment (Rev. 13717, issued July 8, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “Based on the due date identified in PECOS, PECOS will send a revalidation notice (using the applicable letter in section 10.7 et seq. of this chapter) between 90 to 105 days prior to the provider/supplier’s revalidation due date.”; “The contractor shall only accept extension requests from a provider that was not given the full 7 months’ advance notice prior to their revalidation due date.”; “If the supplier fails to respond to the revalidation request, all reassignments shall be end-dated, including the newly established reassignment.”; “If a private practice physical therapist or physical therapist group submits a revalidation application, the contractor shall order a site visit through PECOS.”; “if a private practice physical therapist or physical therapist group is (1) adding a new location or (2) changing the physical location of an existing location, the contractor shall order a site visit of the new/changed location through PECOS.”; “is exclusively an occupational therapy group in private practice – that is, there are no physical therapists in the group – the contractor shall process the application using the procedures in the “limited” screening category. No site visit is necessary.”; “If there is at least one physical therapist in the group, however, the application shall be processed using the procedures in the “moderate” screening category.”; “The provider/supplier is enrolled in an approved status with neither an active reassignment nor practice location for 90 days or longer.”; “The provider’s or supplier’s license has expired and the provider or supplier has not billed while the license was expired.”; “All § 424.540(a)(1) deactivations can only be implemented at CMS’ explicit direction.”; “For example, suppose a provider has a new 10 percent owner as of May 1 and, per § 424.516, must report the change within 30 days – that is, by May 31. The provider fails to do so. The deactivation effective date is the date on which the provider became non-compliant, or June 1.”; “If the provider/supplier submits a change of information and (a) it appears the change was not reported within 90 days of the change, (b) the contractor did not previously take administrative action against the provider/supplier, and (c) no revocation action is applicable, the contractor should process the change of information without deactivating the provider/supplier’s enrollment.”; “The contractor shall process reactivation applications from providers in the “moderate” level of categorical screening (including existing HHAs and DMEPOS suppliers) in accordance with the screening procedures for this category. A site visit is thus needed prior to the contractor’s final decision regarding the application.”; “upon reactivating a Part B non-certified supplier, the contractor shall issue a new PTAN”; “To reactivate its billing privileges, the provider or supplier must submit a complete Medicare enrollment application if the provider or supplier was deactivated: (i) for failing to timely notify the contractor of a change of information”; “This means that the contractor shall not add a retroactive back-billing period (e.g., 30 days) to the reactivation effective date.”; “For Form CMS-855 or CMS-20134 reactivation applications, the timeliness requirements in section 10.5 et seq. of this chapter pertaining to initial enrollment applications apply.”; “These scenarios assume the provider (Smith Health Care) failed to submit the requested revalidation application within the required revalidation timeframe (RRT) – the last day of which, for purposes of our examples, is February 27.”; “switch the PECOS status to “Approved – Stay of Enrollment” effective February 28 (the day after the RRT expired). This means Smith has until March 29 (or 30 days) to submit the revalidation application.”; “Claims for services furnished between February 28 and March 16 (i.e., the duration of the stay) are therefore payable.”; “change the PECOS status to “Deactivated” effective the day after the RRT expired (or February 28)”.
9. 42 CFR. §424.540, Deactivation of Medicare billing privileges (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
   Show the passageHide the passage

   “The provider or supplier does not submit any Medicare claims for 6 consecutive calendar months.”; “The provider or supplier does not report a change to the information supplied on the enrollment application within the applicable time period required under this title.”; “The provider or supplier does not furnish complete and accurate information and all supporting documentation within 90 calendar days of receipt of notification from CMS to submit an enrollment application and supporting documentation, or resubmit and certify to the accuracy of its enrollment information.”; “The provider’s or supplier’s practice location is non-operational or otherwise invalid.”; “The provider or supplier is voluntarily withdrawing from Medicare.”; “In order for a deactivated provider or supplier to reactivate its Medicare billing privileges, the provider or supplier must recertify that its enrollment information currently on file with Medicare is correct, furnish any missing information as appropriate, and be in compliance with all applicable enrollment requirements in this title.”; “CMS may, for any reason, require a deactivated provider or supplier to, as a prerequisite for reactivating its billing privileges, submit a complete Form CMS-855 application.”; “For the deactivation reasons in paragraphs (a)(2) through (4) of this section, the effective date is the date on which the provider or supplier became non-compliant.”; “The effective date of a reactivation of billing privileges under this section is the date on which the Medicare contractor received the provider’s or supplier’s reactivation submission that was processed to approval by the Medicare contractor.”; “A provider or supplier may not receive payment for services or items furnished while deactivated under this section.”.
10. Centers for Medicare & Medicaid Services. NPI Fact Sheet (December 2024). Checked October 25, 2026.
    Show the passageHide the passage

    “Type 1: For individual health care providers, such as physicians, nurse practitioners and sole proprietors. Individuals are only eligible for one NPI.”; “Type 2: For health care organizations, such as hospitals, nursing homes, and physician groups. Organizations can have multiple NPIs.”; “If you are a covered health care provider, you must report any changes to the information provided for your NPI within 30 days of the change.”; “An NPI is required for Medicare enrollment.”; “Updates to a provider’s NPI record in NPPES does not automatically update the provider’s Medicare enrollment information.”.
11. 42 CFR. §455.420, Reactivation of provider enrollment (Medicaid provider screening and enrollment, part 455, subpart E; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “After deactivation of a provider enrollment number for any reason, before the provider’s enrollment may be reactivated, the State Medicaid agency must re-screen the provider and require payment of associated provider application fees under § 455.460.”.
12. 42 CFR. §438.214, Provider selection (Medicaid managed care; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Each State must establish a uniform credentialing and recredentialing policy that addresses acute, primary, mental health, substance use disorders, and LTSS providers, as appropriate, and requires each MCO, PIHP and PAHP to follow those policies.”; “Each MCO, PIHP, and PAHP must follow a documented process for credentialing and recredentialing of network providers.”; “Each MCO, PIHP, and PAHP must comply with any additional requirements established by the State.”.
13. DataSpring, powered by CAQH. Clinicians and Office Staff (the For Clinicians page). Checked October 25, 2026.
    Show the passageHide the passage

    “CAQH is now DataSpring. We enable clinicians and practice management staff to enter information into the CAQH Provider Data Portal and share it with all plans they authorize.”; “profiles actively maintained on a 120-day attestation cycle”; “Enter information once, verify it on a predictable schedule and share it with the plans you designate.”; “This model enables us to provide the platform at no cost to clinicians, provider groups, and practices.”.
14. DataSpring. DataSpring Provider Data Portal (fact sheet, May 2026). “Manage your profile and upload documentation in one secure location.”; “Authorize health plans to access your information for credentialing, directories, and more.”; “Delegate staff to manage non-sensitive information on your behalf”; “Update your profile quarterly to reduce telephone and email requests from plans.”. Checked October 25, 2026.
15. United States Code, 2024 edition (govinfo). 42 U.S.C. 300gg-139, Provider requirements to protect patients and improve the accuracy of provider directory information (Public Health Service Act section 2799B-9, added by the No Surprises Act). Checked October 25, 2026.
    Show the passageHide the passage

    “each health care provider and each health care facility shall have in place business processes to ensure the timely provision of provider directory information to a group health plan or a health insurance issuer”; “Such providers shall submit provider directory information to a plan or issuers, at a minimum”; “when the provider or facility begins a network agreement with a plan or with an issuer with respect to certain coverage;”; “when the provider or facility terminates a network agreement with a plan or with an issuer with respect to certain coverage;”; “when there are material changes to the content of provider directory information of the provider or facility”; “at any other time (including upon the request of such issuer or plan) determined appropriate by the provider, facility, or the Secretary.”; “the term "provider directory information" includes the names, addresses, specialty, telephone numbers, and digital contact information of individual health care providers, and the names, addresses, telephone numbers, and digital contact information of each medical group, clinic, or facility contracted to participate in any of the networks of the group health plan”.
16. United States Code, 2024 edition (govinfo). 42 U.S.C. 300gg-115, Protecting patients and improving the accuracy of provider directory information (Public Health Service Act section 2799A-5, paragraph (a)(2)). Checked October 25, 2026.
    Show the passageHide the passage

    “under which, not less frequently than once every 90 days, such plan or such issuer (as applicable) verifies and updates the provider directory information included on the database described in paragraph (4) of such plan or issuer of each health care provider and health care facility included in such database;”; “that establishes a procedure for the removal of such a provider or facility with respect to which such plan or issuer has been unable to verify such information during a period specified by the plan or issuer;”; “that provides for the update of such database within 2 business days of such plan or issuer receiving from such a provider or facility information pursuant to section 300gg–139 of this title.”.
17. Internal Revenue Service. About Form 8822-B, Change of Address or Responsible Party - Business (page last reviewed or updated June 25, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Use Form 8822-B to notify the Internal Revenue Service if you changed: Business mailing address. Business location. Identity of your responsible party.”; “Changes in responsible parties must be reported to the IRS within 60 days.”.
18. 42 CFR. §438.10, Information requirements (Medicaid managed care, paragraph (h), the provider directory; eCFR, up to date as of October 22, 2026). “An electronic provider directory must be updated no later than 30 calendar days after the MCO, PIHP, PAHP, or PCCM entity receives updated provider information.”. Checked October 25, 2026.
19. 42 CFR. §424.518, Screening levels for Medicare providers and suppliers (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “A Medicare contractor is required to screen all initial applications, revalidation applications, change of ownership applications pursuant to 42 CFR 489.18, applications to add a new practice location, and applications to report any new owner (regardless of ownership percentage)”; “Physician or nonphysician practitioners (including nurse practitioners, CRNAs, occupational therapists, speech/language pathologists, and audiologists) and medical groups or clinics.”; “CMS has designated the following providers and suppliers as “moderate” categorical risk:”; “Physical therapists enrolling as individuals or as group practices.”.
20. Centers for Medicare & Medicaid Services, data.cms.gov. Medicare Revalidation List (interactive tool; data last refreshed October 1, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “This tool is a searchable database that allows you to look up the revalidation due date for Medicare providers who must revalidate their enrollment record information every three or five years.”; “CMS sets every provider’s revalidation due date at the end of a month and posts the revalidation due date six to seven months in advance.”; “A due date of “TBD” means that CMS has not set the due date yet.”; “This data was last refreshed on October 1, 2026. The next data refresh is on November 2, 2026.”; “the dataset also includes subfiles with reassignment information for a given provider as well as due date listings for clinics and group practices and their providers.”.
21. Centers for Medicare & Medicaid Services. Consolidated CMS-855I/CMS-855R Enrollment Applications (bulletin, linked from Medicare Enrollment for Providers & Suppliers). Checked October 25, 2026.
    Show the passageHide the passage

    “Medicare has merged the CMS-855R into the CMS-855I paper enrollment application.”; “Reassigning your Medicare benefits allows an eligible organization/group to submit claims and receive payment for Medicare Part B services that you have provided as a member of the organization/group.”; “Within the Reassignment Topic of your PECOS application, you can add a new reassignment, terminate an existing reassignment or make a change to your reassignment information.”; “In Section 4F, check “Terminate”, furnish the effective date, and complete the appropriate fields in this section”; “statement must be signed by either the practitioner (Section 15B) or the Authorized or Delegated Official (Section 15C)”; “identify the primary and/or secondary location of the organization/group where the practitioner will render in-person services most of the time.”.
22. 42 CFR. §424.502, Definitions (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Authorized official means an appointed official (for example, chief executive officer, chief financial officer, general partner, chairman of the board, or direct owner) to whom the organization has granted the legal authority to enroll it in the Medicare program, to make changes or updates to the organization’s status in the Medicare program”; “Delegated official means an individual who is delegated by the “Authorized Official,” the authority to report changes and updates to the enrollment record. The delegated official must be an individual with ownership or control interest in, or be a W-2 managing employee of the provider or supplier.”; “Final adverse action means one or more of the following actions:”; “Suspension or revocation of a license to provide health care by any State licensing authority;”; “An exclusion or debarment from participation in a Federal or State health care program.”; “Operational means the provider or supplier has a qualified physical practice location, is open to the public for the purpose of providing health care related services, is prepared to submit valid Medicare claims, and is properly staffed, equipped, and stocked”.
23. 42 CFR. §424.555, Payment liability (Medicare provider and supplier enrollment; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “No payment may be made for otherwise Medicare covered items or services furnished to a Medicare beneficiary by a provider or supplier if the billing privileges of the provider or supplier are deactivated, denied, or revoked”; “The Medicare beneficiary has no financial responsibility for expenses, and the provider or supplier must refund on a timely basis to the Medicare beneficiary any amounts collected from the Medicare beneficiary for these otherwise Medicare covered items or services.”.
24. Centers for Medicare & Medicaid Services. Become a Medicare Provider or Supplier (page last modified June 2, 2026; section Keep Your Information Current). Checked October 25, 2026.
    Show the passageHide the passage

    “To avoid having your Medicare billing privileges revoked, be sure to report the following changes within 30 days:”; “a change in ownership”; “an adverse legal action”; “a change in practice location”; “You must report all other changes within 90 days. If you applied online, you can keep your information up to date in PECOS. If you applied using a paper application, you’ll need to resubmit your form to update information.”.
25. 42 CFR. §424.535, Revocation of enrollment in the Medicare program (Medicare provider and supplier enrollment, paragraph (a)(9); eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “Failure to report. The provider or supplier did not comply with the reporting requirements specified in § 424.516(d) or (e)”; “In determining whether a revocation under this paragraph (a)(9) is appropriate, CMS considers the following factors: (i) Whether the data in question was reported. (ii) If the data was reported, how belatedly. (iii) The materiality of the data in question.”.
26. Centers for Medicare & Medicaid Services. Manage Your Enrollment (page last modified March 4, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “If you retire, surrender your license, or no longer want to participate in the Medicare program, you must officially withdraw within 90 days.”; “The PECOS system has print and video tutorials to walk you through different scenarios of withdrawing from Medicare:”; “End a reassignment to an organization but maintain another reassignment to the same organization”; “End employment with an organization”; “End a practice location”; “Failing to withdraw could result in fraudulent billing or having your Medicare billing privileges revoked.”.
27. DrSensory. DrSensory for therapists (the For Therapists hub). Checked October 25, 2026.
    Show the passageHide the passage

    “DrSensory is a directory families use free to find occupational therapy, physical therapy and speech therapy clinics”; “Every clinic keeps a basic listing at no cost.”; “The directory lists clinics rather than individual therapists, so one listing covers a whole practice at one address.”; “Claiming is free and has three steps: find your listing, confirm your email with a six-digit code, choose a password.”; “A published change appears on your profile in about a minute, and you can publish once every seven days.”; “Name, address, phone, map and directions”; “Yes, kept current by you”; ““Verified” means the practice took a subscription and confirmed its own details. It does not mean DrSensory checked its clinical work.”; “When a new therapist frees up capacity, change “Accepting new patients” and the typical wait.”; “Claiming yours and subscribing, at $29.99 a month or $349.99 a year, lets you edit the profile, add your logo, photos and hours”.
28. 42 CFR. §455.450, Screening levels for Medicaid providers (Medicaid provider screening and enrollment, part 455, subpart E; eCFR, up to date as of October 22, 2026). Checked October 25, 2026.
    Show the passageHide the passage

    “A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.””.
29. 42 CFR. §438.602, State responsibilities (Medicaid managed care, paragraph (b); eCFR, up to date as of October 22, 2026). “The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter.”. Checked October 25, 2026.
30. National Committee for Quality Assurance. Credentialing Accreditation FAQs (NCQA Credentialing program). “NCQA Credentialing Accreditation is a comprehensive program that evaluates the operations of organizations providing full-scope credentialing services”; “Credentialing Accreditation assesses an organization’s performance in the following areas:”; “Recredentialing Cycle Length.”; “Find the Standards and Guidelines document in the NCQA Store.”. Checked October 25, 2026.
31. DataSpring, powered by CAQH. Resources (frequently asked questions about the CAQH Provider Data Portal). Checked October 25, 2026.
    Show the passageHide the passage

    “Complete your profile and upload your documents.”; “Attest that all information is truthful and complete.”; “Authorize plans or other organizations to access your profile.”; “No, participation in the CAQH Provider Data Portal is voluntary. However, more than 1,000 health plans and other healthcare organizations have requested that their network providers use the Provider Data Portal for credentialing.”.
32. Aetna. Request to join the Aetna network (Health Care Providers: Join the Aetna Network). “After contracting, and if Credentialing applies, we’ll get your credentialing application from the Council for Affordable Quality Healthcare (CAQH) ProView to begin the credentialing process. Make sure you designate Aetna as an authorized health plan so we can access your application.”. Checked October 25, 2026.
33. UnitedHealthcare. Join our network (UHCprovider.com). “DataSpring, powered by CAQH registration (only required for some states and specialties)”; “If DataSpring is required, make sure attestations and documentation are current”. Checked October 25, 2026.
34. Internal Revenue Service. Understanding your CP575 notice (page last reviewed or updated June 16, 2026). “Keep this notice in your permanent records.”; “No. The original CP575A-J series, Notice of New Employer Identification Number, cannot be duplicated or recreated.”; “Yes. The digital CP575 is accepted by banks and other institutions as written confirmation of an entity’s EIN.”. Checked October 25, 2026.
35. Internal Revenue Service. Employer identification number (page last reviewed or updated July 17, 2026; section EIN confirmation). Checked October 25, 2026.
    Show the passageHide the passage

    “There are 3 ways to confirm your EIN:”; “Request an Entity transcript.”; “Eligible Business Tax Account users can download a digital CP575, Employer Identification Number Verification Notice in BTA. It can be used as a substitute for the original CP575A-J notice series and Letter 147C, EIN Previously Assigned.”; “Call our business and specialty tax line. Request Letter 147C, EIN Previously Assigned.”.
36. U.S. Department of Health and Human Services, Office of Inspector General. Exclusions Program (the List of Excluded Individuals/Entities). Checked October 25, 2026.
    Show the passageHide the passage

    “Those that are excluded can receive no payment from Federal health care programs for any items or services they furnish, order, or prescribe.”; “To avoid CMP liability, health care entities should routinely check the list to ensure that new hires and current employees are not on it.”; “Monthly Supplements”; “Use when you keep your own database version and you only want a list of what has been added or removed this month.”.
37. DrSensory. How to claim and optimize your DrSensory profile (the For Therapists profile guide). Checked October 25, 2026.
    Show the passageHide the passage

    “The change appears on your profile in about a minute. After that you can publish once every seven days.”; “Corrections DrSensory makes from its side do not use up your week.”; “A map, your address with directions, phone, hours or “By appointment only”, website, and a Contact this provider button”; “The languages you speak and the insurance you take appear in a paid profile’s Clinic details box once you fill them in”; “Say the ones that matter in your description too.”.
38. DrSensory. Therapy Clinic Directory Pricing (the pricing page and its frequently asked questions). “$29.99 a month or $349.99 a year for your first location, and $9.99 a month or $99.99 a year for each additional location”; “A description in your own words”; “We do not verify clinical quality.”; “Listing is not an endorsement”. Checked October 25, 2026.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance, billing or financial advice. Each plan’s contract, each state’s Medicaid program and each licensing board set their own requirements, and the worked example is hypothetical, not DrSensory data.