Medicare Revalidation: Due Dates, the 7-Month Rule, and How to Revalidate in PECOS

Medicare revalidation is the periodic renewal of a provider's or supplier's Medicare enrollment record. CMS's revalidation page states it in one sentence: "You're required to revalidate—or renew—your enrollment record periodically to maintain Medicare billing privileges. In general, providers and suppliers revalidate every five years but DMEPOS suppliers revalidate every three years. CMS also reserves the right to request off-cycle revalidations."

Three cycles hide in that quote, and the third is the one practices forget:

• Five years — the general cycle for physicians, non-physician practitioners, and group practices.
• Three years — DMEPOS suppliers.
• Off-cycle — whenever CMS asks. There is no entitlement to a full five years between revalidations.

Mechanically, a provider revalidates enrollment the same way it enrolled: an individual practitioner's record runs on the CMS-855I — the current form explicitly lists "Currently enrolled in Medicare and you received notice to revalidate your enrollment" among the situations it serves — and an organization's record runs on the CMS-855B, with PECOS as the electronic path for both. Revalidation is not a lighter-touch attestation; it is a full recertification of the enrollment record, which is why stale data (an old practice location, a departed Authorized Official, a bank account that no longer exists) turns a routine revalidation into a development-request exchange with the MAC.

Worth pinning early because the terms get swapped in conversation: revalidation is a Medicare obligation owed to CMS through your MAC. Commercial payers run a separate process called recredentialing on their own cycles — the two share nothing but a vague resemblance, and we contrast them in a later section.

If your practice is not yet enrolled and you landed here while planning ahead — sensible, since the revalidation clock starts at approval — our Medicare provider enrollment service handles the initial NPPES-to-PECOS build and sets up the tracking that makes the first revalidation a non-event.

The due date is not a secret and you do not need to wait for mail. CMS states: "You can search the Medicare Revalidation List to find a due date for an individual or organizational provider. CMS posts revalidation due dates seven months in advance." The list lives at data.cms.gov/revalidation and is searchable by individual or organizational provider.

Two details in that sentence do real work:

1. "Individual or organizational provider." A group practice does not have one due date. The organization's enrollment record has its own, and each practitioner's individual record has its own. Search them all.
2. "Seven months in advance." A record with no due date showing is not exempt — it means the date has not been posted yet; keep checking.

The seven-month posting window also defines the filing window, and this is the rule that catches diligent practices — the ones that try to revalidate early. From the same CMS page: "DON'T Revalidate If… Your due date is more than seven months away unless you've received a revalidation notice. These unsolicited revalidations will be returned." Filing early out of caution does not bank you goodwill; the MAC returns the application and you have spent effort producing nothing.

The flip side: "DO Revalidate If… You're within three months of your revalidation due date, even if you haven't received a notification." A lost letter or a notice sent to a stale correspondence address does not move the date. Inside three months, file regardless.

The operational habit that follows from all this is a standing calendar check, not a reaction to mail: query the Revalidation List for every NPI and organizational record on your Medicare enrollments at a fixed monthly interval, and log what it shows. This is the same discipline behind our provider enrollment checklist — the enrollment record is an asset that needs a maintenance schedule, not a document you file and forget.

The MAC — not CMS centrally — administers your revalidation, and it does send advance warning: "Your enrollment contractor will send a revalidation notice to you via email or U.S. postal mail about three to four months prior to your due date."

Note the channels: email or U.S. postal mail. An email notice is easy to lose to a spam filter or to the inbox of a credentialing coordinator who left last year; a mailed notice goes to the correspondence address on the enrollment record, which is only as current as the last change-of-information filing. Both failure modes are common, and CMS has pre-emptively closed the "we never got the letter" defense: "Although revalidation notices are sent ahead of time, you're responsible for keeping track of your due date."

So treat the notice as confirmation, not as the trigger. The trigger is the due date on the Revalidation List, which was posted months before any notice went out. A practice that only acts on notices is running a three-to-four-month runway; one that acts on the list runs seven.

When the notice does arrive, read it rather than filing it — it identifies which enrollment record and which MAC jurisdiction it covers. Practices enrolled with more than one MAC (multiple states, or Part B plus DMEPOS) can receive notices from different contractors on different schedules for what feels like "the same practice." Each one is a separate obligation against a separate enrollment record.

CMS is explicit about the preferred path: "PECOS is the most efficient way to submit your revalidation. It allows you to: Review information currently on file, Upload your supporting documents, Electronically sign and submit your revalidation online." Paper remains legal — the CMS-855I for an individual practitioner, the CMS-855B for a clinic or group practice — but everything CMS publishes points at PECOS, and CMS notes elsewhere that "PECOS applications tend to process faster than paper applications."

Here is the sequence as it actually runs, with the failure points marked:

1. Confirm you can log in — weeks before the deadline, not the night of. PECOS login uses the Identity & Access (I&A) Management System: "Please use your I&A (Identity & Access Management System) user ID and password to log in." I&A now runs Multi-Factor Authentication, and a locked or orphaned account (the departed office manager problem) takes time to recover. Two housekeeping facts from CMS's own PECOS FAQ: "CMS recommends that PECOS users change their PECOS passwords at least once a year. User IDs cannot be changed."
2. Confirm who will do the work. The Authorized Official (AO) signs; staff or a third party can be set up as a surrogate connection through I&A to work on the provider's behalf. What nobody may do is share a login — the I&A system states: "Sharing of login information is strictly prohibited!" (I&A terms). This matters at revalidation because it is precisely the moment practices are tempted to hand credentials to a helper.
3. Review every screen of the record against reality. This is the substance of revalidation. Practice locations, ownership, managing employees, reassignments, correspondence address, the AO on file. Anything that changed since the last submission and was never reported becomes either a correction now or a development request later. Development requests stop the clock and stretch the timeline.
4. Upload supporting documents, e-sign, submit. The three PECOS capabilities CMS lists — review, upload, e-sign — are the whole electronic transaction. If banking changed since the last submission, that is a separate action: CMS-588 authorizes electronic funds transfer, and the form lists two reasons for submission — "New EFT Enrollment" and "Change to Current EFT Enrollment (e.g. account or bank changes)." A revalidation with unchanged banking does not need one.
5. Track it until the MAC finalizes it. The MAC processes the application; submission is not completion. On speed, quote only what MACs publish and read it as a goal, not a promise: National Government Services states on its provider-enrollment FAQ page that "All MACs, including National Governments Services, have a goal to finalize an Internet-based PECOS application within 15 days and a CMS-855 paper application within 30 days, if all required information is available" — and "if all required information is available" is the load-bearing clause. Novitas publishes CMS-defined processing timeframes on its website in percentile form with a list of clock-stopping events. Neither is a guarantee.

First time inside PECOS, or inheriting an account nobody documented? Our PECOS enrollment guide walks the I&A account structure — AO, Access Manager, surrogate connection — from zero.

CMS states the consequences without hedging: "Failing to revalidate on time could result in a hold on your Medicare reimbursement or deactivation of your Medicare billing privileges."

The two outcomes are very different in cost:

• A payment hold stops reimbursement while the enrollment record stays alive. Cash flow suffers; the record survives. Completing the revalidation releases it.
• Deactivation switches the billing privileges off, and reactivation is not a phone call: "If your Medicare billing privileges are deactivated, you'll need to re-submit a complete Medicare enrollment application to reactivate your billing privileges." A complete application — the same lift as enrolling, with the same document staging and the same MAC processing queue. The current CMS-855I lists reactivation among the scenarios the form serves; our provider enrollment checklist covers what a complete package means, because an incomplete reactivation application extends exactly the gap you are trying to close.

The sentence that should drive the calendar discipline is the third one: "Medicare won't reimburse you for any services during the period that you were deactivated." Not delayed — unpaid. A practice that keeps seeing Medicare patients through a deactivation gap is donating those visits. Deactivation also strands the practical machinery of billing: the PTAN the MAC issued at enrollment stops functioning as an active billing credential until the record is reactivated.

And there is no relief valve. "There are no exemptions from revalidation. Additionally, CMS doesn't grant extensions; your notification email or letter will allow sufficient time to revalidate before your due date." No hardship extension, no grace period, no exemption category. The seven-month public posting and the three-to-four-month notice are the entire accommodation CMS offers.

If a hold or deactivation has already landed, sequence matters: identify which enrollment record triggered it (in a group it is often one practitioner's individual record, not the organization's), file the complete revalidation or reactivation application immediately, and respond to any development request the same week it arrives — the MAC's processing clock pauses while it waits on you.

Practices routinely conflate Medicare revalidation with commercial recredentialing because both are periodic "prove you still exist" exercises. Operationally they share almost nothing, and treating them as one workflow is how one of them gets missed.

The structural difference: Medicare revalidation is one process with public rules and a public due-date list; recredentialing is a dozen private processes with a dozen clocks. A group that participates with eight commercial payers plus Medicare is running nine renewal calendars, and only Medicare's is published. Cycle lengths, attestation cadences, and what each commercial payer actually publishes are covered in our payer credentialing timeline and cost breakdown.

One trap at the boundary: keeping CAQH current does nothing for Medicare, and a clean PECOS record does nothing for commercial payers. The two systems do not read each other. Every demographic change — new location, new legal name, new banking — has to be reported into both worlds separately, and revalidation is usually when the un-reported Medicare half surfaces.

A group practice's Medicare presence is a web, not a record: the organization enrolls in Medicare through PECOS using CMS-855B, each practitioner enrolls using CMS-855I, and each practitioner reassigns benefits to the group. Revalidation hits every strand of that web on its own schedule — CMS's Revalidation List carries due dates "for an individual or organizational provider," separately.

What that means at, say, a twelve-physician group:

• Thirteen enrollment records minimum — one organizational, twelve individual — each with its own due date, none synchronized. Practitioners bring their existing enrollment history with them, so a physician hired last year may revalidate before the group does.
• One roster, checked monthly. Query the Medicare Revalidation List for the organizational record and every practitioner NPI on the reassignment roster. Log the dates. This is a fifteen-minute monthly task that replaces every fire drill.
• Signature authority planned in advance. The current regulation draws the line more strictly than older CMS training decks: 42 CFR 424.510(d)(3)(ii), as amended effective December 2, 2025, requires that the initial enrollment application "and all subsequent enrollment applications submitted for periodic revalidation" be signed by an Authorized Official — "Any updates or changes reported outside of the initial enrollment or periodic revalidation process may be signed by a delegated official(s)" (42 CFR 424.510). Plan for the Authorized Official to sign every periodic revalidation; route interim updates and changes through a Delegated Official who was reported on the enrollment record beforehand. The current I&A Quick Reference Guide (dated 01/20/2026) uses the role name Access Manager for the I&A-side delegation: "An individual, delegated by the Authorized Official… with the authority to legally bind the organization and conduct business on behalf of the organization" (I&A guide).
• Third-party help through the front door. The I&A system defines a surrogate as an organization — explicitly including "billing agency, credentialing consultant, or other staffing company" — authorized "to access, view, and modify information within CMS computer systems on their behalf." That is the mechanism, and it is the only compliant one: CMS prohibits credential sharing outright. This is also our own policy — MedPrecision never asks for CMS or PECOS usernames or passwords; the client's AO retains control, and we work on the provider's behalf through an approved I&A surrogate connection.
• Watch the coupling. A practitioner whose individual record deactivates for missed revalidation is a practitioner whose services the group cannot bill, even though the group's own record is spotless. Group-level tracking exists precisely because the weakest individual record sets the group's exposure.

Our ongoing enrollment management runs this loop as a service — list monitoring, notice triage, PECOS submission, and development-request response across the whole roster — for groups that would rather not staff it internally.

The Medicare enrollment application fee exists, applies at revalidation for those who owe it, and is irrelevant to most readers of this page. CMS's MLN provider-enrollment page states both halves, and precisely (verified 11 August 2026):

Who is exempt: "Physicians, non-physician practitioners (NPPs), physician organizations, non-physician organizations, and Medicare Diabetes Prevention Program (MDPP) suppliers don't pay a Medicare enrollment application fee." A physician group practice revalidating its CMS-855B enrollment pays nothing — the exemption covers the organization, not just the individuals.

Who pays, and when: "Generally, institutional providers and suppliers like DMEPOS suppliers and opioid treatment programs pay an application fee when enrolling, re-enrolling, revalidating, or adding a new practice location." Note "revalidating" in that list — for the supplier types that owe the fee, it is due at every revalidation, not just at initial enrollment.

The amount: "The 2026 enrollment application fee is $750," per the same CMS MLN page. The figure resets annually, so a DMEPOS supplier on the three-year cycle will meet a different number each time.

If a "Medicare revalidation fee" invoice or demand reaches a physician practice from anyone other than CMS's own fee-payment flow, treat it with suspicion — physician organizations owe CMS nothing at revalidation, and the fee, where owed, is paid to CMS, not to a third party.