Medicaid provider revalidation by state

The short version

• Federal floor: at least every five years. Under 42 CFR 455.414, every state Medicaid agency must revalidate the enrollment of all providers, regardless of type, at least every five years.
• Seven states use a shorter general cycle: Arizona (48 months), Kansas (36 months), New Mexico (36 months), Oklahoma (48 months), South Carolina (36 months), Tennessee (36 months), Wisconsin (36 months).
• Many states shorten it for some provider types. DME and DMEPOS suppliers are often on a three-year cycle, and several states revalidate high-risk providers every one to three years.
• Off-cycle revalidations are happening. California, Missouri, Tennessee, Wyoming and others describe CMS-directed or state-initiated off-cycle revalidations of high-risk providers in 2026 and later.
• Medicaid and Medicare are separate. Medicare revalidates on its own five-year cycle (three years for DMEPOS suppliers) under 42 CFR 424.515. A provider in both programs has two due dates.

Revalidation cycle by state

Cycle length is the state’s general cycle in months. “Stated by the state” means the linked official page states the cycle directly (32 rows). “Verify with the state” means the source is official but indirect, for example a State Plan assurance, a page restating the federal rule, or a document behind a login (19 rows).

How to use this table

1. Start from the provider’s last approval date in that state, not only the date they first enrolled. Cycles are usually counted from enrollment or the last accepted revalidation (New Hampshire says so explicitly); Hawaii counts from the approval letter date and Ohio from the effective date of the last agreement.
2. Check the provider type. If the provider is a DME supplier, a high-risk type or out of state, look for a shorter cycle in the notes column and on the state’s page.
3. Watch for the state’s notice. Most states send a revalidation notice or post a due date in their provider portal. That date wins over any calculation.
4. Start early. Revalidation asks for much of the same information as enrollment. Opening the work four to six months ahead leaves room for missing documents and follow-up questions.
5. Track Medicare separately. If the provider also bills Medicare, the Medicare revalidation date comes from CMS, not from this table.

How we compiled it

For each state we looked for the state Medicaid agency’s own statement of its revalidation cycle: provider enrollment pages, provider manuals, billing guides, administrative rules, State Plan pages and official presentations. Each row links to the page we used. Where the only official statement was indirect, we kept the five-year federal minimum and marked the row “Verify with the state”. Unofficial sources were never used to set a cycle; where one suggested a shorter cycle that we could not confirm (for example Georgia), the note says so.

The same data sets the default revalidation schedule in Credentik, where each agency can override it with its own rule for a payer, state or provider. If you find a row that has changed, email hello@credentik.com with the source and we will update it.

Tracking revalidation for many providers

For one provider in one state, a calendar reminder works. For an agency with dozens of providers across several states and payers, the dates multiply quickly: each state, each Medicare enrollment and each commercial payer recredentialing has its own clock.

Credentik’s recredentialing and revalidation tracking gives every provider, payer and state its own cycle, calculates the next due date from the rule that applies, opens a prefilled application ahead of time, and alerts your team at the lead times you choose.

Federal sources

• 42 CFR 455.414, Revalidation of enrollment (Medicaid): law.cornell.edu/cfr/text/42/455.414
• 42 CFR 424.515, Requirements for reporting changes and updates to and the periodic revalidation of Medicare enrollment information: law.cornell.edu/cfr/text/42/424.515
• State sources: linked in each row of the table above.