Medicare PECOS revalidation — how to hit the five-year clock without losing a month of billing

The short answer: Medicare revalidation runs on a five-year clock. Miss the deadline and billing privileges deactivate, and reactivation requires a new enrollment application with full processing time. Check each provider’s due date in the CMS revalidation lookup — don’t wait for the letter.

Medicare PECOS revalidation runs on a five-year clock. The clock starts the day a provider is initially enrolled and resets each time they revalidate. The deadline is firm: if a provider misses the revalidation window, their Medicare billing privileges deactivate.

When that happens:

• The provider can no longer bill Medicare for services rendered after the deactivation date.
• Claims already submitted with dates of service in the deactivation window are denied.
• Reinstatement requires a new initial enrollment, which can take 60 to 90 days — sometimes longer.
• The provider’s Medicare effective date for the new enrollment is the date CMS processes the reinstatement, not the date the gap started. The intervening time is unbillable.

For a provider with a meaningful Medicare patient panel, the cost is direct and large.

This is the discipline that prevents it.

How CMS notifies providers (and why notifications get missed)

CMS sends revalidation notices through the MAC (Medicare Administrative Contractor) for the provider’s region. The notice arrives by mail at the provider’s address of record in PECOS, generally 6 months before the revalidation deadline.

Several things commonly go wrong:

1. The address of record is outdated. A provider who moved practices and never updated PECOS receives the notice at an old address. The notice never reaches them.
2. The notice goes to a credentialing department that doesn’t exist. Many providers’ PECOS contact info lists a credentialing manager who has since left. The notice arrives, gets thrown away, and the deadline slips silently.
3. The notice arrives but doesn’t look urgent. “Time to revalidate” is not the same urgency as “your Medicare enrollment will deactivate.” Providers sometimes set it aside.
4. The provider doesn’t know they’re in a revalidation window at all. PECOS does not consistently surface revalidation timing in the dashboard view a practice logs into.

The result: revalidation deadlines are routinely missed even by providers who would have taken the action immediately if they’d known.

The CMS revalidation lookup tool

CMS maintains a public revalidation lookup at data.cms.gov/tools/medicare-revalidation-list. Enter a provider’s NPI and the tool returns the next revalidation due date.

This is the source of truth. It is not buried; it is not behind a login. Practices can — and should — check the lookup quarterly for every provider on staff.

When we onboard a new roster, the CMS revalidation lookup is one of the first tools we hit. It’s how we identify which providers are already in the danger zone before we touch any other system.

The discipline that prevents the gap

The five-year clock is forgiving in one important way: it gives you years of lead time if you’re tracking it.

Here is the cadence we run:

At onboarding

• Pull every provider’s NPI through the CMS revalidation lookup.
• Capture the next revalidation due date for each provider.
• Flag anyone within 12 months of revalidation as immediate work.

Quarterly

• Re-pull the CMS revalidation lookup for the full roster.
• Verify nothing has shifted (occasionally CMS adjusts dates after data corrections).
• Cross-check against PECOS contact info: address of record, authorized officials, EFT info.

At 12 months out

• Begin the revalidation work: pull the most recent PECOS data, confirm the practice locations, ownership disclosures, reassignment of benefits, and EFT.
• If anything has changed since the last enrollment, prepare the updated documentation.

At 6 months out

• Submit the revalidation through PECOS.
• Document the submission in the credential file — the PECOS submission tracking ID, the submission date, the documents transmitted.

At 3 months out

• Verify status. PECOS revalidations are typically processed within 60 to 90 days when complete.
• If the MAC requests additional information, respond within the window they specify.

After approval

• Capture the new revalidation effective date.
• Reset the five-year clock in the credential calendar.

Run that loop on every Medicare-enrolled provider on the roster and you will not miss a deadline.

What to do if a provider’s privileges already deactivated

If you discover a provider whose Medicare billing privileges have already deactivated:

1. Stop billing Medicare for that provider immediately. Continuing to bill creates compliance risk on top of the lost revenue.
2. Pull the deactivation notice or letter from the MAC. If you can’t find it, the MAC will provide a copy on request. You need the exact deactivation date for the chart.
3. Submit a new initial enrollment through PECOS (not a revalidation — the privileges are gone). This includes CMS-855I for individual providers or CMS-855B for groups.
4. Document every claim that needs to be held until reinstatement. After reinstatement, the provider’s Medicare effective date is forward-looking; you will not be able to bill for services in the gap.
5. Communicate with the practice’s billing team. They need to know to flag every Medicare claim until you confirm reinstatement.

The reinstatement timeline is generally 60 to 90 days from submission. During that window, the provider can see Medicare patients but cannot bill Medicare. Most practices either shift the provider’s panel to non-Medicare patients or accept the lost revenue. There is not a faster path.

The honest version of why this happens

Most practices we work with do not have a person whose job is “track Medicare revalidations.” It’s an unowned task. The provider’s start date was five years ago; the credentialing manager who handled the original enrollment may have moved on; PECOS notifications go to addresses that no longer match the practice.

When responsibility is unowned, deadlines slip. That’s not a Medicare-policy problem; it’s an operations problem.

The fix is to own the calendar — on a system that surfaces it. We do this for our clients on Metolius. Every Medicare-enrolled provider has a next-revalidation date attached to their record. The dashboard surfaces anyone within 18 months. The work queue surfaces anyone within 12 months. Nothing falls off because the calendar tells us first.

You can do the same thing on a spreadsheet for a small roster, as long as you actually look at it every quarter. The platform matters less than the discipline.

What to do this week

1. List every Medicare-enrolled provider on staff.
2. Pull each NPI through the CMS revalidation lookup.
3. Sort by next revalidation due date.
4. Anyone within 12 months is immediate work. Pull the PECOS file, verify the data, prepare the revalidation submission.
5. Anyone within 18 to 36 months — schedule a calendar event at the 12-month mark.

If you’d like us to run the lookup and the calendar for your roster, that’s what we do. Talk to us and we’ll show you a current revalidation queue on Metolius — yours or one of ours.

— Medical Credentialing Services