The cycles at a glance
| Cycle | How often | Who sets it |
|---|---|---|
| Health plan recredentialing | At least every 36 months under NCQA standards; some plans or contracts set their own terms | The health plan, following NCQA or other accreditor standards |
| Medicare revalidation | Every 5 years; every 3 years for DMEPOS suppliers | CMS (42 CFR 424.515) |
| Medicaid revalidation | At least every 5 years; several states use 3 or 4 years and many shorten it for some provider types | Each state (42 CFR 455.414 sets the floor) |
| CAQH ProView re-attestation | Every 120 days | CAQH |
| State license renewal | Set by each board, and varies by state and profession | The state licensing board |
| DEA registration | Set by the DEA for each registration | DEA |
| Hospital reappointment | Set by the hospital’s bylaws and accreditor | The hospital medical staff |
Health plan recredentialing
Health plans re-verify each network provider’s credentials on a cycle. Plans accredited by NCQA must recredential at least every 36 months, and NCQA has said the cycle cannot be extended except in narrow cases such as active military duty or medical leave. Recredentialing typically re-verifies license, board certification, malpractice history and sanctions, and reviews the provider’s performance with the plan.
The plan usually starts the process, often by pulling the provider’s CAQH ProView profile. That makes a current, attested CAQH profile the most useful thing you can maintain between cycles.
Medicare revalidation
Medicare providers and suppliers must resubmit and recertify their enrollment information every five years; DMEPOS suppliers every three years (42 CFR 424.515). CMS can also ask for off-cycle revalidation.
CMS publishes due dates in the Medicare Revalidation List, searchable by NPI, organization or individual. CMS sets due dates at the end of a month and posts them about six to seven months ahead. Groups should check both their own due date and those of the providers who reassign benefits to them.
Medicaid revalidation
Each state Medicaid agency must revalidate all providers at least every five years (42 CFR 455.414), and states may require it more often. Arizona and Oklahoma use four years; Kansas, New Mexico, South Carolina, Tennessee and Wisconsin use three; and many states put DME suppliers or high-risk provider types on shorter cycles. Medicaid managed care plans usually recredential separately on their own cycle.
Our Medicaid revalidation by state table lists every state’s cycle with a link to the official source.
Keeping track of all of them
For one provider enrolled with four commercial plans, Medicare and two Medicaid programs, that is seven recredentialing or revalidation clocks, plus CAQH, licenses and DEA. Across an agency’s clients, it becomes hundreds of dates. A few habits help:
- Record a separate due date for each payer, program and state, not one per provider
- Record where each date came from: a payer notice, the CMS list, a state cycle or your own calculation
- Start work four to six months ahead; many requests ask for the same documents as initial enrollment
- Keep CAQH attested and documents current between cycles, so recredentialing is mostly confirmation
- Know which payers terminate the enrollment on a lapse, and treat those dates as hard deadlines
How Credentik tracks cycles
Credentik keeps one cycle per provider, payer and state, anchored to the latest approved effective date. The due date comes from the first rule that applies: a dated override, your agency’s payer rule, Medicare’s schedule, the state’s Medicaid cycle or your default. Alerts go out at the lead times you choose, and a prefilled application opens automatically. See recredentialing and revalidation tracking.