PECOS Enrollment: A Step-by-Step Guide for Providers

PECOS — the Provider Enrollment, Chain, and Ownership System — is the internet-based system CMS maintains for Medicare provider and supplier enrollment. It is the digital home of the paper CMS-855 application family: anything you could mail on an 855 form, you can file (faster, with built-in validation) in PECOS. Your Medicare Administrative Contractor (MAC) processes whatever you submit there.

Enrollment is not the same as credentialing, and the distinction trips up new practices constantly. Credentialing is the verification of your education, training, licensure, and work history that a payer (or a hospital) performs before granting participation. Enrollment is the act of registering with a specific payer's billing system — for Medicare, that is PECOS — so claims under your NPI actually adjudicate and pay. You can be a fully licensed, board-certified physician and still have every Medicare claim deny because you were never enrolled, or because your enrollment lapsed. For a fuller breakdown of how these two processes interlock, see our provider enrollment glossary entry and the difference between enrollment and credentialing.

Why it matters operationally: an active, accurate PECOS record is a precondition for getting paid by Medicare, for reassigning your benefits to a group so the group can bill on your behalf, and — increasingly — for other providers to bill. Medicare denies lab, imaging, DME, and home-health claims when the ordering or referring provider is not enrolled in PECOS, so your enrollment status affects downstream billers, not just you. In our enrollment work we routinely trace a cluster of CO-16 / N264 / N265 denials back to a single referring physician whose PECOS record had quietly deactivated at revalidation — a reminder that PECOS hygiene is a revenue issue, not just a paperwork one.

The single most important early decision is picking the correct 855 form. Filing the wrong one is the most common cause of an enrollment being returned or rejected. The form is determined by what you are enrolling — an individual, an organization, a reassignment, or an order/refer-only role — not by your specialty.

A few decision rules that resolve most confusion:

• Solo practitioner billing under their own NPI/Tax ID: file an 855I (and a CMS-588 if you are setting up EFT). No 855B needed.
• A new group entity: file an 855B for the group, plus an 855I for each individual who will reassign benefits to it — the 855I both enrolls any individual not already enrolled and carries the reassignment itself (the 855R that formerly did this was discontinued October 31, 2023).
• Joining an existing group as an already-enrolled physician: you typically report the reassignment to the new group on an 855I change of information (formerly a separate 855R, discontinued October 31, 2023) — you do not re-do your whole individual enrollment from scratch.
• A physician who never bills Medicare but orders labs/imaging or certifies home health: file an 855O so their NPI is PECOS-enrolled for ordering/referring (this prevents downstream CO-16/N264 denials).

When in doubt, the controlling question is: am I enrolling a person, an organization, a reassignment, or an order-only role? That answer selects the form.

The 2023 update: the CMS-855R is discontinued

An update to the form family above. The current CMS-855I carries this note on its face: "NOTE: All reassignment actions should now be reported via the CMS-855I. The CMS-855R (Reassignment of Medicare Benefits) form has been discontinued" (CMS-855I form). CMS's Provider Enrollment & Oversight Group dates the change precisely: the consolidated CMS-855I was "Released on September 1, 2023" and the "855R was discontinued effective October 31, 2023" (CMS 2024 provider enrollment keynote). Practitioners and groups now establish, terminate, or change reassignments using only the 855I — in PECOS or on the paper form.

What has not changed: reassignment still means a practitioner reassigns benefits to the group — authorizing an eligible organization/group to bill and receive payment for the practitioner's Part B services — and the 855I still requires that "both the individual practitioner and the eligible organization/group must be currently enrolled (or concurrently enrolling via submission of the CMS-855B for the eligible organization/group and the CMS-855I for the individual practitioner) in the Medicare program before the reassignment can take effect."

For the post-2023 workflow step by step — adding a physician to a group today, terminating a reassignment, and what happens if someone submits an old 855R — see our CMS-855R discontinuation and reassignment guide. Section-level walkthroughs of the two surviving forms live in the CMS-855B guide for groups and clinics and the CMS-855I guide for individual practitioners.

PECOS does not create your identity — it links to one. Two prerequisites must exist before you can submit anything.

1. An active NPI (National Provider Identifier). You obtain your NPI from NPPES (the National Plan and Provider Enumeration System), not from PECOS. Individuals get a Type 1 NPI; organizations get a Type 2 NPI. PECOS enrollment is then associated with that NPI — your Medicare billing privileges attach to it. If your NPPES information (legal name, practice address, taxonomy) is wrong or out of date, it can cause a PECOS mismatch, so reconcile NPPES first. An NPI without a Medicare enrollment cannot bill Medicare; an NPI with an active PECOS enrollment can.

2. An I&A (Identity & Access Management System) account. Before logging into PECOS you register in I&A, which controls who is authorized to act on a provider's or organization's behalf. I&A is where you establish roles — Authorized Official (AO), Delegated Official (DO), and authorized/staff-end users — so that a credentialing coordinator or billing company can manage the enrollment without the physician keying everything personally.

Information to have ready before you open the application:

• Legal business name and Tax Identification Number (TIN/EIN), plus SSN for individuals
• NPI(s) — Type 1 for the individual, Type 2 for the group
• State license number(s), DEA (if applicable), board certification, and medical school/training history
• Practice location address(es) — a physical practice address is required; a PO box alone will not do
• Correspondence and "special payments" addresses
• Ownership and managing-control information (names, SSNs, addresses) for the entity
• Bank account details for EFT (CMS-588)
• Any final adverse legal actions to disclose

Gathering this packet before you start is the single biggest determinant of speed. A PECOS application that stalls almost always stalls because a license number, an ownership disclosure, or a supporting document was missing — and the MAC issues a development request that adds weeks. Our provider enrollment checklist lays out the full document set so the application goes in complete the first time.

Who works in PECOS: the I&A roles behind every application

One clarification before the role definitions, because Medicare search results mix two audiences: enrollment throughout this guide means provider enrollment — a practitioner or organization registering to bill Medicare — never a beneficiary choosing coverage.

PECOS login runs through the Identity & Access (I&A) Management System. The PECOS login page itself instructs: "Please use your I&A (Identity & Access Management System) user ID and password to log in" (PECOS login). Who holds which I&A role therefore decides who can file, sign, and manage your Medicare enrollment — and it is the part of the setup new groups most often get wrong. The role definitions below come from the current I&A Quick Reference Guide (dated January 20, 2026).

A naming wrinkle worth knowing: the January 2026 I&A guide uses "Access Manager (AM)" while PECOS screens still reference delegated officials (DOs) — a live PECOS system notice dated August 10, 2026 still says "delegated officials (DOs)" — so expect to meet both terms for the delegated tier. CMS's provider-enrollment training materials add the signing limit that matters: a delegated official "may sign changes, updates, and revalidations but not initial applications" (CMS PE-101 deck, August 2024).

Two hard rules follow from I&A's own terms. First, credential sharing is banned: "Sharing of login information is strictly prohibited!" (I&A terms) — and the system enforces Multi-Factor Authentication on every account. Second, that prohibition is exactly why a legitimate Medicare provider enrollment service never asks for your PECOS or I&A password: the AO keeps control of the account, approves a surrogate connection from the My Connections tab in I&A, and the enrollment company works through that connection. Anyone who asks you to hand over CMS credentials is asking you to violate the I&A terms of service.

The sequence below is the clean-application path. The same flow applies whether you file online in PECOS or on paper; PECOS just validates as you go and routes electronically to your MAC.

1. Confirm (or obtain) the NPI in NPPES. Verify legal name, address, and taxonomy match what you will enter in PECOS. Fix NPPES first if anything is stale.
2. Set up your I&A account and roles. Register the Authorized Official / Delegated Official and connect the individual's or organization's identity. Grant your enrollment staff or billing company surrogate access here.
3. Select the correct 855 form / enrollment scenario in PECOS. Individual = 855I; new group = 855B; reassignment = reported on the 855I (the 855R was discontinued October 31, 2023); order/refer-only = 855O; DMEPOS = 855S; institutional = 855A. (See the form table above.)
4. Complete every required section. Identifying information, specialty, all practice locations, licensure, ownership/managing control, and the EFT/CMS-588 banking information. Incomplete sections are the #1 cause of development requests.
5. Add reassignments where applicable — on the 855I (the 855R is discontinued). For a group, link each individual's billing rights to the group's Type 2 NPI/TIN. This is what lets the group bill for that provider's services.
6. Upload supporting documentation. License, IRS CP-575 / TIN confirmation, voided check or bank letter for EFT, and any documents the specific scenario requires.
7. Sign and certify. The individual practitioner or the Authorized Official must e-sign (or sign the printed CMS-855 certification statement). An unsigned certification will get the application returned.
8. Submit and pay any application fee. Institutional providers, suppliers, and DMEPOS pay a CMS application fee; most individual physician 855I enrollments do not. Verify the current fee in PECOS at submission.
9. Track the MAC's review and respond fast to development requests. The MAC verifies your data, may conduct a site visit (for certain supplier types), and may issue a development letter requesting clarification. Respond within the deadline stated in the MAC's development letter — or the application can be rejected and you start over.
10. Receive approval and note your effective date. Once approved, confirm your effective date and the date you may begin billing (see the effective-date section below).

Work these in order. Skipping the NPPES reconciliation or the I&A setup forces you to backtrack mid-application, and submitting before the EFT and signature steps are complete guarantees a return.

Reassignment is the mechanism that lets a group bill Medicare for the services its physicians and practitioners perform. Since October 31, 2023 it is reported on the CMS-855I — the standalone CMS-855R was discontinued (see the form-family update above). Understanding it prevents the classic "the doctor is enrolled but the group still can't get paid" problem.

What reassignment actually does. By default, Medicare pays the individual who furnished the service. Reassignment transfers that right to bill and receive payment to the group/employer. After an approved reassignment, the group bills under the group's Type 2 NPI and TIN with the individual's Type 1 NPI identified as the rendering provider on the claim. Both NPIs appear on the claim, and both enrollments must be active and correctly linked in PECOS for the claim to pay.

The two-NPI relationship in plain terms:

• Type 1 (individual) NPI — identifies who performed the service (rendering provider).
• Type 2 (organization) NPI — identifies who is billing and being paid (billing provider).
• The reassignment (reported on the 855I; formerly the standalone 855R) is the bridge: it ties the individual's billing rights to the group's TIN so Medicare knows the group is authorized to bill for that person.

Common reassignment scenarios:

• New hire at an existing group: the already-enrolled physician reports the reassignment to the group on an 855I change of information (adding the new practice location in the same filing). The group does not file a new 855B.
• Physician works at two groups: they can reassign to multiple TINs — a separate reassignment per group, each reported on the 855I. Each reassignment is independent.
• Physician leaves a group: the group (or the individual) should terminate the reassignment in PECOS. Leaving stale reassignments active is a compliance and audit risk.

The most expensive linkage mistake is billing under the group before the reassignment is approved, or with the wrong rendering/billing NPI combination. Those claims deny — and if the reassignment is never properly established, you may lose them to timely filing. In our enrollment audits, a recurring root cause of group-level Medicare denials is a reassignment that was submitted but never finalized, so the group billed for a provider Medicare did not yet recognize as reassigned to that TIN. Confirm the reassignment shows as approved in PECOS before the first claim goes out.

Two money questions sit inside every enrollment packet: whether you owe the application fee, and how the approved enrollment actually connects to a bank account.

The application fee: who pays $750 and who is exempt

The Medicare enrollment application fee for calendar year 2026 is $750 — "The 2026 enrollment application fee is $750," per CMS's MLN Medicare Provider Enrollment page, as updated for 2026 and verified August 2026.

Most physician practices never owe it. CMS's exemption language on the same page: "Physicians, non-physician practitioners (NPPs), physician organizations, non-physician organizations, and Medicare Diabetes Prevention Program (MDPP) suppliers don't pay a Medicare enrollment application fee. Generally, institutional providers and suppliers like DMEPOS suppliers and opioid treatment programs pay an application fee when enrolling, re-enrolling, revalidating, or adding a new practice location."

In practice: a physician or NPP group practice enrolling through CMS-855B pays nothing, while a non-physician organizational supplier filing the same form (an IDTF or opioid treatment program, for example) does owe the fee. For supplier types that owe it, the CMS-855B instructs that the supplier pays the required application fee via the PECOS fee-payment page "upon initial enrollment, the addition of a new business location, and revalidation PRIOR to completing and submitting this application to the MAC" — pay first, then submit, or the application stalls at intake.

CMS-588 and EFT: connecting the enrollment to a bank account

CMS-588 authorizes electronic funds transfer — it is the "Electronic Funds Transfer (EFT) Authorization Agreement" (OMB 0938-0626), and it is the step that connects an approved enrollment to a bank account. The form itself lists two reasons for submission: "New EFT Enrollment" or "Change to Current EFT Enrollment (e.g. account or bank changes)."

What the CMS-588 is not: an enrollment. The form states, "EFT enrollment does not constitute enrollment as a provider or supplier in the Medicare program" — it rides alongside the 855, it does not replace it.

Two rules on the form cause most of the silent rejections we see:

• The signer rule. "The EFT authorization form must be signed and dated by the same Authorized Representative or a Delegated Official named on the CMS-855 Medicare enrollment application which the Medicare contractor has on file." A CMS-588 signed by the office manager when the 855 names the practice owner as AO does not match the MAC's file, and the mismatch surfaces weeks later.
• One form per contractor. "An EFT authorization form must be submitted for each Medicare contractor to whom you submit claims for Medicare payment." A practice enrolled in two MAC jurisdictions files two.

Submission routes are on the form too: "Upload this form to PECOS or mail this form to the Medicare contractor that services your geographical area." And the obligation continues after approval — the certification has the provider agree that "If my Financial Institution information changes, I agree to submit to CMS an updated EFT Authorization Agreement," so a bank switch mid-year means a new CMS-588, not just a call to the MAC. The full completion walkthrough, including what to stage before you file, is in our CMS-588 EFT guide.

Once the application is in, three things matter: knowing where it stands, answering the MAC fast, and calibrating expectations against what MACs actually publish — which is goals and CMS-defined timeframes, not guarantees.

Checking status. PECOS is the master record: CMS maintains enrollment data submitted on the CMS-855 forms in PECOS, and describes the system as letting registered users "Review information currently on file," upload supporting documents, and manage enrollment information electronically (CMS PECOS enrollment applications page). Log back in with the I&A credentials used to file; for anything PECOS does not show, the MAC processing the application is the authoritative contact.

Development requests. When the MAC finds something missing or unclear, it issues a development request — and the published processing timeframes below assume they never happen ("if all required information is available" is the operative clause). Treat a development letter as a same-week task: route it to whoever holds the surrogate connection or the AO seat, answer every item in one response, and keep proof of submission. Slow or partial responses are how applications fall out of the published bands entirely — and, past the deadline stated in the MAC's development letter, how they get rejected and refiled.

Published MAC timeframes (as of August 2026, framed exactly as the MACs frame them):

National Government Services — the Jurisdiction K MAC for New York and New England — states on its provider-enrollment hot-topics article (reviewed September 2, 2025): "All MACs, including National Governments Services, have a goal to finalize an Internet-based PECOS application within 15 days and a CMS-855 paper application within 30 days, if all required information is available." That is a stated goal, not a commitment. The article sits behind a query-string URL, so find it by searching ngsmedicare.com for its application status hot topic.

Novitas Solutions publishes CMS-defined processing timeframes on its enrollment-status page (also behind a dynamic URL — search novitas-solutions.com for "enrollment status inquiry timeframes"):

Read the pattern, because it is the strongest published argument for the PECOS route: on Novitas's own numbers, a clean PECOS filing clears in a fraction of the time of a paper filing that draws a site visit or development.

The two levers that move your timeline. First, completeness: the difference between a clean 855 and one missing a license number or an ownership disclosure is the difference between a single review pass and repeated development round-trips — every published timeframe above applies only "if all required information is available." Second, lead time: start well before the provider's first patient day so the effective date and the 30-day retro window (below) protect the opening weeks of revenue rather than leaving them unbillable. Practices that treat enrollment as a project to launch before hiring, with a complete packet and tracked deadlines, are the ones for whom the published goals hold; those that file reactively draw the development requests that stop the clock.

Approval. The MAC processes the application and issues the PTAN: "When a MAC approves enrollment and issues an approval letter, the letter will include the PTAN assigned to the health care professional or supplier" (CMS MLN glossary). That number, alongside your NPI, is what identifies you in Medicare from then on — what it is, how it relates to the NPI, and how to recover a lost one is covered in our PTAN guide.

Your effective date and retroactive billing rules

Your effective date determines the earliest date of service you can bill, and it is governed by CMS rule — you do not get to choose it. Misunderstanding it is how practices lose the first weeks of a new provider's revenue.

The general rule. For physicians, non-physician practitioners, and physician/NPP organizations, the effective date is the later of (a) the date the MAC received a signed, processable enrollment application that was subsequently approved, or (b) the date the provider first began furnishing services at the new practice location. In short: the clock starts when a clean application lands at the MAC, not when you decide to apply.

Retroactive billing window. CMS allows limited retrospective billing for services furnished before the application was filed but after all requirements were met. For physicians and qualifying suppliers, that retrospective window is generally up to 30 days prior to the effective date — extended to 90 days only in a Presidentially-declared disaster/emergency that prevented timely enrollment. This is exactly why you should file before a provider starts, not after: every day you wait past the 30-day lookback is a day of services that can never be billed.

Practical takeaway: start the PECOS application 60–90 days before the provider's first patient day. Because credentialing with commercial payers runs in parallel and often takes longer, an early Medicare filing protects the effective date while everything else catches up. "Verify the current CMS rule with your MAC" applies to specifics — but the later-of effective date and 30-day retro framework are the load-bearing rules to plan around.

Enrollment is not set-and-forget. CMS requires every enrolled provider and supplier to revalidate their entire Medicare enrollment record on a recurring cycle, and missing it is one of the most common — and most preventable — causes of a sudden wave of Medicare denials.

The cadence:

• Most providers and suppliers: every 5 years.
• DMEPOS suppliers: every 3 years.

CMS sets each provider a revalidation due date (you can look yours up on the CMS revalidation lookup tool), and your MAC sends a revalidation notice ahead of it. You revalidate by submitting a complete, current 855 application in PECOS — the same form you would use to enroll (855I for individuals, 855B for groups, 855S for DMEPOS) — reverifying every section. CMS can also request off-cycle revalidation at any time for program-integrity reasons.

What happens if you miss it. If you do not revalidate by the due date, the MAC can place a hold on your claims and ultimately deactivate your enrollment. Deactivation does not erase your enrollment history, but it stops payment: claims with dates of service after the deactivation date deny until you reactivate, and reactivation can leave a coverage gap that costs real revenue. Worse, a deactivated referring physician triggers CO-16 / N264 / N265 denials on every lab, imaging, and DME claim that names them — so one missed revalidation can ripple across an entire referral network.

How to stay ahead of it:

1. Track every provider's revalidation due date in a credentialing calendar with 6-month, 90-day, and 30-day alerts. Do not wait for the MAC letter — letters get lost.
2. Respond as soon as the notice arrives. Submit the revalidation 60–90 days before the due date so a development request does not push you past deactivation.
3. Keep PECOS continuously accurate. A record that is already current (correct addresses, licenses, ownership, reassignments) revalidates in minutes; a stale one becomes a full clean-up project under deadline pressure.
4. Reconcile reassignments at revalidation. This is the natural moment to terminate stale reassignment links (established via the 855I today; historically via the discontinued 855R) for departed providers and confirm active ones.

Proactive revalidation tracking is the single highest-ROI piece of enrollment maintenance — it prevents an entirely avoidable revenue interruption. Outsourced provider enrollment services typically own this calendar so no due date is ever missed.

Most enrollment delays are self-inflicted and fall into a short, repeatable list. Avoiding these keeps you inside the MACs' published processing goals and out of the development-request loop.

1. Filing the wrong 855 form. Submitting a bare 855I when you needed an 855B plus reassignment-bearing 855Is for a new group, or skipping the 855O for an order/refer-only physician. Re-read the form table and confirm whether you are enrolling a person, an organization, a reassignment, or an order-only role before you start.
2. NPPES / PECOS data mismatch. A legal name, address, or taxonomy that differs between NPPES and PECOS stalls the application. Reconcile NPPES first.
3. Incomplete ownership and managing-control disclosures. Groups must report owners and managing officials; omissions trigger development requests and, if they look like concealment, integrity scrutiny.
4. Missing or wrong EFT (CMS-588) information. The CMS-588 authorizes electronic funds transfer — submitted for new EFT enrollment or banking/account changes — and a bad routing number or missing bank documentation holds the whole application.
5. Billing before the reassignment is approved. The group bills under its TIN before Medicare has finalized the link (reported on the 855I since the 855R's discontinuation), and the claims deny — sometimes past timely filing. Confirm "approved" in PECOS first.
6. Missing the revalidation due date. The quiet killer. A lapsed revalidation deactivates the enrollment and, for referring providers, triggers downstream CO-16 / N264 / N265 denials across the referral network. Track due dates proactively.
7. Ignoring or slow-walking a development request. The MAC's letter states its own response deadline. Miss it and the application is rejected; you re-file and lose the queue position and potentially the favorable effective date.
8. Filing too late. Starting the application after the provider has already begun seeing patients sacrifices billable revenue beyond the 30-day retro window. File 60–90 days early.

A disciplined enrollment function — complete packets, NPPES reconciliation up front, tracked deadlines, and reassignment verification before first claim — converts PECOS from a recurring source of denials into routine, predictable maintenance. For practices without internal bandwidth, our provider credentialing and provider enrollment services own the form selection, submission, development responses, and the revalidation calendar end to end.