Surviving the 2026 Re-Credentialing Crunch: Timelines, PECOS, and CAQH Rules

:::info Quick answer The re-credentialing process verifies a provider's qualifications every 36 months for commercial payers or 5 years for Medicare. You must start applications 120 days before expiration. Keep CAQH ProView attested every 120 days, update expiring DEA and malpractice documents immediately, and monitor PECOS revalidation notices to prevent CO-24 claim denials. :::

If you bill medical claims for a living, you already know the worst kind of denial is the one that was entirely preventable. Letting a physician fall out of network because somebody missed a CAQH attestation email is a fast track to unpaid claims, furious providers, and a messy retroactive appeal process.

In September 2026, the stakes are higher than ever. Commercial payers are aggressively enforcing the directory accuracy mandates from the Consolidated Appropriations Act (CAA). If your practice fails to complete the re-credentialing process on time, payers won't just deny your claims—they will drop your providers from their patient-facing directories. Patients won't find your doctors, and claims will hit your desk with CO-24 (Charges are covered under a capitation agreement/managed care plan) or PR-B7 (This provider was not certified/eligible to be paid for this procedure/service on this date of service).

Here is exactly how to manage the re-credentialing gauntlet this year, keep your CAQH profiles bulletproof, and survive the Medicare revalidation cycle without dropping a single date of service.

The NCQA 36-Month Cycle and the 120-Day Rule

The National Committee for Quality Assurance (NCQA) dictates the standard for commercial credentialing. Under NCQA guidelines, health plans must re-credential network providers at least every 36 months. Some state Medicaid programs and specific HMOs require it every 24 months, but 36 months is your baseline for Aetna, UnitedHealthcare, Cigna, and most Blue Cross Blue Shield plans.

You cannot wait until month 35 to start this work. The golden rule for revenue cycle managers is to initiate re-credentialing 120 days prior to the expiration of the current contract.

Working Backward from Expiration

If a provider’s commercial contract expires on December 31, your workflow starts in late August.

• Day 120 (T-minus 4 months): Audit the provider's CAQH ProView profile. Pull fresh copies of their malpractice insurance (COI), DEA certificate, state license, and board certification. Ensure none of these underlying documents expire within the next 90 days.
• Day 90 (T-minus 3 months): Payer notices typically arrive. Some payers send automated emails via CAQH; others still mail physical letters to the practice's correspondence address. Respond immediately. If the payer requires a proprietary form outside of CAQH, submit it via their provider portal with delivery receipt.
• Day 60 (T-minus 2 months): Follow up via the payer's credentialing hotline. Get a reference number for the call and ask explicitly: "Are there any deficiencies in the file?"
• Day 30 (T-minus 1 month): Demand a status update. If the file is stalled in the payer's committee review, escalate to your provider representative.

CAQH ProView: The Engine of Re-Credentialing

Most commercial payers rely on CAQH ProView to pull provider data. If your CAQH profile is out of date, the re-credentialing process halts completely. Payers will not chase you down for an updated DEA license; they will simply close the file, terminate the provider, and deny your claims.

The Mandatory 120-Day Attestation

CAQH requires providers (or their delegated credentialing staff) to attest to the accuracy of their profile every 120 days. This is a hard stop. If you fail to attest, payers lose access to the profile data.

Smart billing managers do not wait for the CAQH reminder emails. You should build a master credentialing matrix that tracks the expiration dates of the "Big Five" documents for every provider in your group:

1. State Medical License: Varies by state (often renews every 1-2 years on the provider's birth month).
2. DEA Registration: Renews every 3 years.
3. State Controlled Dangerous Substances (CDS) License: Required in states like Texas and New Jersey; often renews annually.
4. Malpractice Insurance (Certificate of Insurance): Typically renews annually for the whole practice. You must upload the new face sheet showing the individual provider's name and coverage limits (usually $1M/$3M).
5. Board Certification: Varies by specialty board.

When you upload a new document to CAQH, you must enter the new expiration date manually. The system does not read PDFs. If your malpractice renews on January 1, 2027, but the CAQH date field still says January 1, 2026, the payer's automated system will flag the provider as uninsured and suspend their re-credentialing.

Medicare Revalidation: Navigating PECOS

Medicare does not use the term "re-credentialing." They use "revalidation." Under the Affordable Care Act, CMS requires providers and suppliers to revalidate their enrollment information every five years (for physicians and non-physician practitioners) or every three years (for DMEPOS suppliers).

CMS sends revalidation notices exactly two to three months prior to your due date. In 2026, you will receive these notices via the Medicare Administrative Contractor (MAC) portal, email, or a yellow envelope in the mail. Do not ignore the yellow envelope.

Using PECOS for Revalidation

You have two choices for Medicare revalidation: mail a paper CMS-855I (and CMS-855R for reassignments) or use the Provider Enrollment, Chain, and Ownership System (PECOS). Always use PECOS. Paper applications in 2026 still suffer from a 45-to-60-day processing lag, whereas clean PECOS submissions often clear in 15 to 30 days.

To revalidate an individual provider reassigned to a group practice:

• Log into PECOS using the provider's Identity & Access (I&A) credentials (or your surrogate login).
• Select "Revalidate" from the My Enrollments page.
• Review the practice locations, EFT information, and reassignment of benefits.
• Sign electronically.

Physicians and non-physician practitioners reassigning benefits to a clinic do not pay an application fee. However, institutional providers (like hospitals, ambulatory surgery centers, and home health agencies) must pay the institutional application fee, which sits at $731 for calendar year 2024 and adjusts slightly upward annually for inflation through 2026.

The Medicare Deactivation Trap

If you miss your Medicare revalidation due date, your billing privileges are deactivated. Deactivation is not the same as revocation, but the financial pain is identical: your claims will reject instantly.

If deactivated, you must submit a complete revalidation application to reactivate. Medicare will grant a retroactive billing date back to the date of receipt of the new application. Any dates of service between the deactivation date and the receipt of the new application are unbillable to Medicare. You cannot bill the patient for these errors. You must write them off.

Comparing Re-Credentialing Cycles

Different entities follow distinct timelines. Keep this reference table handy when building your internal tracking systems.

Delegated Credentialing vs. Direct Contracts

Large group practices often utilize delegated credentialing. If your group holds a delegated contract with a payer like Blue Cross Blue Shield, the re-credentialing process shifts entirely in-house.

Under a delegated agreement, the payer trusts your practice's internal credentialing committee to verify primary source documents (education, licenses, NPDB queries). Instead of submitting individual applications for every provider, you simply send the payer a monthly roster. If a provider passes your internal re-credentialing, you list them as "Active" on the roster, and the payer updates their system.

However, delegated credentialing requires your group to pass an annual NCQA or URAC audit by the payer. If your internal committee fails to run a National Practitioner Data Bank (NPDB) query on a provider at their 36-month mark, the payer can strip your delegated status, forcing you back to direct credentialing for every single doctor.

Handling Denials Due to Lapsed Credentials

Even with the best matrices, mistakes happen. A provider takes maternity leave, misses a CAQH email, and gets termed by Cigna. Suddenly, CPT 99214s are hitting your clearinghouse with CO-24 denials. What now?

1. Fix the Root Cause First

Do not just blind-appeal the claims. Go straight to CAQH, update the expired documents, and attest. Then, call the payer's credentialing department and ask for reinstatement.

2. Request a Retroactive Effective Date

Once the provider is approved, fight for a retroactive effective date. If the provider was termed on June 1, and you got them re-approved on July 15, you have a 45-day gap. Submit a formal appeal letter stating that the provider never stopped seeing patients at the contracted location, was continuously licensed, and maintained continuous malpractice coverage. Provide the updated COI and DEA. Some commercial payers will backdate the approval and allow you to re-process the claims.

3. The Out-of-Network Reality

If the payer refuses to backdate, those claims process as out-of-network. If the patient has out-of-network benefits (like a PPO), you will be paid at the lower non-par rate, and the patient will face a higher coinsurance. If the patient has an HMO, the claims will deny completely to patient responsibility. Be warned: billing a patient for thousands of dollars because your front office forgot to update a medical license is the fastest way to generate a state insurance board complaint.

Building a Foolproof Tracking System

To prevent lapsed credentialing, ditch the sticky notes and build a rigid, centralized tracking system. Whether you use a dedicated software platform like Modio or a highly formatted Excel spreadsheet, your system must include:

• Provider Name, NPI (Type 1), and CAQH ID.
• Medicare PTAN and Medicaid Provider ID.
• Exact expiration dates for State License, DEA, CDS, and Malpractice.
• CAQH Next Attestation Date (set a calendar reminder for Day 110).
• Medicare Revalidation Due Date (check the CMS lookup tool monthly).
• Commercial Payer Contract Dates (track when the 36-month clock resets for each major payer).

Re-credentialing is not a one-and-done administrative chore; it is continuous revenue protection. In 2026, payers are actively looking for reasons to trim their networks and hold onto their cash. Don't give them an easy excuse by letting a simple expiration date slip through the cracks.

Frequently asked questions

How often do providers need to go through the re-credentialing process?

For most commercial payers (like UHC, Aetna, Cigna), providers must be re-credentialed every 36 months to comply with NCQA guidelines. Medicare requires revalidation every five years for physicians and every three years for DME suppliers.

What happens if I miss my Medicare revalidation deadline?

Your Medicare billing privileges will be deactivated. You will not be paid for any services rendered between the deactivation date and the date Medicare receives your new, complete revalidation application.

How often do I need to attest in CAQH ProView?

Providers must attest to the accuracy of their CAQH ProView profile every 120 days. If you fail to attest, commercial payers cannot pull your data and may terminate your network participation.

Can I bill retroactively if my credentialing lapses?

It depends on the payer. Medicare generally will not pay for services provided during a deactivation gap. Some commercial payers may grant a retroactive effective date upon appeal if you prove continuous licensure and malpractice coverage, but it is never guaranteed.

What is the fee for Medicare revalidation in 2026?

Individual physicians reassigning benefits to a group practice do not pay a fee. Institutional providers (like ASCs or clinics enrolling as a group) must pay the annual institutional application fee, which adjusts slightly each year (e.g., $731 in 2024).