Medicare Revalidation in 2026: Why a Missed Deadline Can Trigger Deactivation and Added Audit Scrutiny

Every Medicare-enrolled provider and supplier must periodically revalidate its enrollment, which means resubmitting and recertifying the accuracy of its enrollment information. Revalidation can feel like routine paperwork, but missing a deadline can have serious consequences. CMS warns that failing to revalidate on time could result in a hold on Medicare reimbursement or deactivation of Medicare billing privileges, and that Medicare will not pay for services furnished during a period of deactivation.

In 2026, revalidation has taken on added importance. Federal agencies are paying close attention to provider enrollment as part of a broader focus on program integrity. Executive Order 14395, which established the White House Task Force to Eliminate Fraud, directs agencies to develop processes for recommending wide-scale revalidations to deter fraudulent providers. CMS's CRUSH request for information asked whether states should require high-risk Medicaid providers to revalidate more often than every five years. CMS has also imposed nationwide enrollment moratoria on hospices, home health agencies, and certain DMEPOS suppliers.

This article explains how Medicare revalidation works, how to find your due date, what happens if you miss it, how deactivation differs from revocation, how revalidation connects to audit scrutiny, and practical steps to stay compliant.

What Is Medicare Revalidation?

CMS describes revalidation as resubmitting and recertifying your enrollment information, and calls it an important anti-fraud tool. All Medicare-enrolled providers and suppliers must periodically revalidate their enrollment information under 42 CFR 424.515.

How Often Providers Must Revalidate

• Most providers and suppliers revalidate every five years.

• DMEPOS suppliers revalidate every three years.

• CMS can also conduct off-cycle revalidations at any time.

CMS has stated that there are no exemptions from revalidation and that it does not grant extensions.

Off-Cycle Revalidation Example

An example of off-cycle revalidation is CMS's effort to collect expanded ownership, management, and related party information from skilled nursing facilities. CMS sent revalidation notices to SNFs in late 2024, extended the deadline several times, and later indefinitely suspended the January 1, 2026 deadline, while still allowing SNFs to submit applications. This shows that CMS uses revalidation not only for routine renewal but also to gather enhanced information.

How to Find Your Revalidation Due Date

The Medicare Revalidation List

CMS publishes revalidation due dates through the Medicare Revalidation List, a searchable tool on data.cms.gov. Key points:

• Revalidation due dates are set at the end of a month.

• CMS posts due dates up to seven months in advance.

• A due date shown as "TBD" means CMS has not yet set the due date.

• The list is updated periodically, generally every 60 days at the start of the month.

CMS has also noted that it reestablished due dates after the COVID-19 public health emergency and that providers should not submit revalidation until a newly established due date appears.

Revalidation Notices

CMS states that your Medicare Administrative Contractor (MAC) will send a revalidation notice by email or postal mail about three to four months before your due date. However, CMS emphasizes that providers are responsible for tracking their own due dates, even if they do not receive a notice.

When to Submit

CMS's guidance includes simple rules:

• Do revalidate if you are within three months of your due date, even if you have not received a notice.

• Do not revalidate if your due date is more than seven months away, unless you have received a revalidation notice. CMS states that unsolicited revalidations will be returned.

How to Revalidate

Providers can revalidate through the Provider Enrollment, Chain, and Ownership System (PECOS) or by submitting the appropriate paper Medicare enrollment application, such as Form CMS-855A for institutional providers, Form CMS-855B for clinics, group practices, and certain suppliers, Form CMS-855I for physicians and non-physician practitioners, and Form CMS-855S for DMEPOS suppliers. CMS notes that when using PECOS, providers only need to update information that has changed.

Revalidation requires:

• Reviewing all enrollment information on file.

• Updating information that has changed, such as owners, managing employees, practice locations, and banking information.

• Uploading supporting documentation as required.

• Paying the application fee, if applicable to your provider type, or requesting a hardship exception.

• Signing the certification by an authorized individual, such as the individual provider or an authorized or delegated official for an organization.

Respond to Development Requests

After submission, the MAC may request additional information or documentation. CMS states that if the MAC requests additional documentation, you should respond within 30 days, and if you do not, the MAC may deactivate your Medicare billing privileges.

What Happens If You Miss the Deadline?

Stay of Enrollment

CMS describes a stay of enrollment as an interim action taken against non-compliant providers before imposing a deactivation or revocation. It applies when a provider is non-compliant with at least one enrollment requirement that can be fixed by submitting a CMS-855 application, such as failing to respond to revalidation or development requests, or ownership discrepancies. CMS states that the stay temporarily pauses enrollment while the provider comes into compliance. CMS's MLN guidance states that if you submit your revalidation after its due date, your MAC may apply a stay of enrollment that will hold your Medicare payments or deactivate your billing privileges.

Deactivation

Deactivation stops a provider's ability to bill Medicare. Under 42 CFR 424.540, CMS may deactivate billing privileges for several reasons, including failing to respond to a revalidation request and not submitting claims for an extended period.

CMS explains the consequences of deactivation:

• To reactivate, the provider must submit a complete Medicare enrollment application.

• Medicare will not reimburse the provider for any services during the period it was deactivated.

• The reactivation effective date is generally based on the date the complete application is received.

CMS conference materials also explain that MACs issue deactivation letters with rebuttal rights, and that depending on the circumstances, a new Provider Transaction Access Number (PTAN) may be issued upon reactivation, although certified providers such as hospices are treated differently.

The Financial Impact

The most significant financial consequence is the gap in coverage. Services furnished while billing privileges are deactivated are not payable, which can mean weeks or months of lost revenue that cannot be recovered. For group practices, deactivation of individual practitioners can also affect the group's ability to bill for those practitioners' services.

Deactivation vs. Revocation

Deactivation and revocation are different:

• Deactivation, under 42 CFR 424.540, is an administrative action that stops billing privileges but does not mean the provider is being removed from Medicare for misconduct. CMS states that deactivation does not impact a certified provider's Medicare certification and provider agreement in the non-billing context, and that a new survey is not required to reactivate a deactivated hospice or HHA.

• Revocation, under 42 CFR 424.535, terminates enrollment for reasons such as noncompliance with enrollment requirements, false or misleading information, abusive billing, or certain convictions, and generally includes a re-enrollment bar.

CMS's manual instructions direct contractors not to revoke a provider solely for failing to respond to a revalidation request unless CMS directs otherwise. However, revalidation can uncover issues, such as inaccurate information or noncompliance, that may lead to revocation.

Non-Billing Deactivation

Revalidation is not the only enrollment requirement that can lead to deactivation. CMS can deactivate providers that do not bill Medicare for an extended period. According to CMS's 2026 provider enrollment compliance conference materials:

• CMS began deactivating hospices in March 2024, and home health agencies in January 2026, after six consecutive months of non-billing if certain criteria are met.

• Other Part A providers, DME suppliers, and individual practitioners are generally deactivated after 13 consecutive months of non-billing if certain criteria are met.

• Effective January 2026, individual providers enrolled using Form CMS-855O for ordering and referring only are deactivated if they are not identified on claims after 13 consecutive months.

Why Revalidation Problems Can Lead to Added Audit Scrutiny

Revalidation is more than a renewal form. It is a screening event, and enrollment data is increasingly used in program integrity analytics.

Revalidation Triggers Screening

When a provider revalidates, the MAC screens it according to its assigned risk level under 42 CFR 424.518. Limited, moderate, and high risk levels involve different checks, ranging from license verification and database checks to site visits and, for high-risk categories, fingerprint-based criminal background checks of certain owners. Screening can reveal discrepancies that lead to further review.

Enrollment Data Feeds Fraud Analytics

CMS has explained in congressional testimony that it links Medicare and Medicaid claims data with provider ownership information and other data sources to identify suspicious patterns, and that its Advanced Provider Screening system monitors licensure status, criminal activity, and identity information. Inaccurate or outdated ownership, location, or managing employee information can create inconsistencies that draw attention.

Discrepancies Can Lead to Stays, Deactivation, or Revocation

CMS lists ownership discrepancies among the issues that can trigger a stay of enrollment. Providing false or misleading information on an enrollment application can be grounds for revocation under 42 CFR 424.535(a)(4) and can lead to a re-enrollment bar. CMS has also proposed, in its CY 2027 Home Health Prospective Payment System proposed rule, to expand revocation authority to cover false or misleading information on any CMS or Medicare enrollment-related form.

Policy Focus on Revalidation

Revalidation is a stated priority of current federal anti-fraud efforts:

• Executive Order 14395 directs the Task Force to Eliminate Fraud to analyze identifying information for providers and develop a process for recommending wide-scale revalidations to deter fraudulent providers.

• CMS's CRUSH request for information asked whether states should require high-risk Medicaid providers to revalidate more often than every five years.

• CMS has proposed additional grounds for denying and revoking enrollment, including grounds related to changes in majority ownership for hospices, HHAs, and DMEPOS suppliers.

Payment Holds Can Look Like Larger Problems

A payment hold or deactivation caused by a missed revalidation can disrupt cash flow and operations at the same time an organization may be dealing with medical review or other audits. Avoiding preventable enrollment problems helps organizations focus their resources on substantive compliance.

Reporting Changes Between Revalidations

Revalidation is easier and less risky when enrollment information is kept current throughout the cycle. Under 42 CFR 424.516, providers must report certain changes within specific timeframes, such as changes of ownership or control, adverse legal actions, and practice location changes, generally within 30 days for many of these changes, and other changes within 90 days. Specific timeframes vary by provider type, so providers should confirm the requirements that apply to them.

CMS's materials also note that MACs may notify providers of bank account closures or routing changes reported by banks, with a period to comply before deactivation.

Special Considerations for Group Practices and Reassignments

Group practices face additional complexity because both the group and each individual practitioner have their own enrollment records and revalidation due dates. Physicians and non-physician practitioners commonly reassign their Medicare benefits to the group so that the group can bill for their services.

CMS publishes a Revalidation Reassignment List and a Revalidation Clinic Group Practice Reassignment dataset that show reassignment relationships and revalidation dates for practitioners and the groups to which they reassign benefits. Groups can use this information to track upcoming revalidations for their practitioners.

Practical steps for groups include:

• Maintain a roster of all practitioners who reassign benefits to the group, with each person's revalidation due date.

• Coordinate with practitioners who work for more than one organization, because their revalidation affects every group to which they reassign benefits.

• Make sure departing practitioners' reassignments are ended and new practitioners' reassignments are established promptly.

• Remember that deactivation of an individual practitioner can prevent the group from being paid for that practitioner's services.

Common Revalidation Mistakes

• Relying only on the MAC's notice instead of checking the Medicare Revalidation List.

• Sending notices to an unmonitored mailbox or outdated address.

• Submitting revalidation too early, more than seven months before the due date without a notice, resulting in a returned application.

• Submitting incomplete applications or missing supporting documents.

• Forgetting to update ownership, managing employees, or practice locations that changed since the last enrollment.

• Allowing the authorized official's PECOS access to lapse.

• Missing the deadline to respond to a development request.

• Overlooking the application fee, when applicable.

• Assuming that a group's revalidation covers individual practitioners, or the reverse.

A Practical Revalidation Compliance Plan

1. Build an Enrollment Calendar

• Look up revalidation due dates for your organization and every enrolled practitioner using the Medicare Revalidation List.

• Check the list regularly, at least every 60 days, and record each due date in a shared compliance calendar with reminders at six, three, and one month before the due date.

• Track Medicaid revalidation dates separately, because states generally revalidate Medicaid providers at least every five years under 42 CFR 455.414.

2. Keep Contact Information Current

• Make sure the correspondence address, special payments address, and email addresses on file are monitored, because revalidation notices are sent to these addresses.

• Designate a person responsible for reviewing MAC correspondence promptly.

3. Assign Responsibility

• Designate an enrollment coordinator and a backup.

• For group practices, establish a process for tracking individual practitioners' revalidations and reassignments.

4. Prepare Before the Notice Arrives

• Review your PECOS record annually, not just at revalidation.

• Gather current ownership, managing employee, location, licensing, and banking information.

• Confirm that authorized and delegated officials are current and have PECOS access.

5. Submit Complete, Accurate Applications

• Verify every piece of information before submitting.

• Include all required supporting documents.

• Pay the application fee, if applicable.

• Keep a copy of the submission and confirmation.

6. Respond to Development Requests Quickly

• Monitor PECOS and email for MAC development requests.

• Respond within the deadline, generally 30 days.

7. Prepare for Site Visits

• Make sure locations match enrollment records, are staffed during posted hours, and display required signage.

• Train staff on how to handle a site visit.

8. Monitor Billing Activity

• Be aware of non-billing deactivation rules, especially for hospices and HHAs, which may be deactivated after six months without billing.

• If a location or practitioner will stop billing, decide whether to report the change or voluntarily withdraw rather than allowing an unplanned deactivation.

9. Know What to Do If You Are Deactivated

• Read the deactivation letter carefully and note any rebuttal deadline.

• Submit a complete enrollment application as quickly as possible to minimize the gap in billing privileges.

• Consider whether a rebuttal is appropriate if the deactivation was issued in error.

• Track claims for services furnished during the deactivation period and understand that they are generally not payable.

10. Integrate Enrollment Into Your Compliance Program

• Include enrollment accuracy in your annual compliance risk assessment.

• Audit enrollment records periodically against actual operations, ownership, and staffing.

• Report enrollment status to leadership.

Frequently Asked Questions

How often do I need to revalidate?

Most providers and suppliers revalidate every five years, and DMEPOS suppliers revalidate every three years. CMS can also request off-cycle revalidation.

How far in advance are due dates posted?

CMS posts revalidation due dates up to seven months in advance on the Medicare Revalidation List.

Can I get an extension?

CMS states that it does not grant extensions and that there are no exemptions from revalidation.

Will I be paid for services while deactivated?

No. CMS states that Medicare will not reimburse providers for services furnished during the period of deactivation.

Is deactivation the same as revocation?

No. Deactivation stops billing privileges until the provider comes back into compliance, while revocation terminates enrollment and usually includes a re-enrollment bar.

What if I never received a revalidation notice?

You are still responsible for tracking your due date. CMS advises submitting your revalidation if you are within three months of your due date, even without a notice.

Does revalidation include a site visit?

It may. Site visits depend on your screening risk level under 42 CFR 424.518. Providers in the moderate and high risk categories are subject to site visits, and CMS and its contractors may also conduct site visits in other circumstances to verify that a provider is operational and meets enrollment requirements.

Do I need to revalidate my Medicaid enrollment separately?

Yes. Medicaid enrollment is managed by each state. Under 42 CFR 455.414, states must revalidate the enrollment of all Medicaid providers at least every five years, and some states may set their own schedules or additional requirements. Track each state's requirements separately from Medicare.

What if my ownership has changed since my last enrollment?

Ownership changes generally must be reported within the timeframes in 42 CFR 424.516, not saved for revalidation. If changes were not reported, correct them promptly and consult your Medicare contractor or counsel, because inaccurate ownership information can lead to a stay of enrollment or other action.

Conclusion

Medicare revalidation is a recurring requirement with significant consequences when it is missed. A late or incomplete revalidation can lead to a stay of enrollment, payment holds, or deactivation, and services furnished during deactivation are not payable. In 2026, with federal attention focused on provider enrollment, ownership transparency, and wide-scale revalidation as fraud prevention tools, accurate and timely revalidation is also an important way to avoid unnecessary scrutiny.

Providers can protect themselves by tracking due dates on the Medicare Revalidation List, keeping enrollment information current throughout the cycle, submitting complete and accurate applications, responding quickly to development requests, preparing for site visits, monitoring billing activity, and integrating enrollment into their compliance programs.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare enrollment, compliance, and audit readiness. We help providers track revalidation due dates, review and update PECOS records, prepare complete revalidation applications, respond to development requests, prepare for site visits, and resolve deactivation issues. If you would like help managing Medicare revalidation and enrollment compliance for your organization, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Revalidations (Renewing Your Enrollment). https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/revalidations

• Centers for Medicare & Medicaid Services. Medicare Revalidation List. https://data.cms.gov/tools/medicare-revalidation-list

• Centers for Medicare & Medicaid Services. Revalidation Due Date List Data. https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/revalidation-due-date-list

• Centers for Medicare & Medicaid Services. Revalidation Reassignment List Data. https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/revalidation-reassignment-list

• Centers for Medicare & Medicaid Services, Medicare Learning Network. Medicare Provider Enrollment (MLN9658742). https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/EnrollmentResources/provider-resources/provider-enrolment/Med-Prov-Enroll-MLN9658742.html

• Centers for Medicare & Medicaid Services. Medicare Enrollment for Providers and Suppliers. https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/chain-ownership-system-pecos

• Centers for Medicare & Medicaid Services. Medicare Provider Enrollment Compliance Conference Keynote (March 2026). https://www.cms.gov/files/document/2026-cms-keynote-present-future-provider-enrollment.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08 Medicare Program Integrity, Transmittal 575. https://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r575pi.pdf

• Centers for Medicare & Medicaid Services. Provider Enrollment Moratoria. https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/chain-ownership-system-pecos/provider-enrollment-moratoria

• Federal Register. Calendar Year 2027 Home Health Prospective Payment System Rate Update; Medicare Provider Enrollment and DMEPOS Policies, Proposed Rule (July 6, 2026). https://www.federalregister.gov/documents/2026/07/06/2026-13602/calendar-year-2027-home-health-prospective-payment-system-hh-pps-rate-update-requirements-for-the-hh

• Federal Register. Request for Information (RFI) Related to Comprehensive Regulations To Uncover Suspicious Healthcare (CRUSH), 91 FR 9803 (February 27, 2026). https://www.federalregister.gov/documents/2026/02/27/2026-03968/request-for-information-rfi-related-to-comprehensive-regulations-to-uncover-suspicious-healthcare

• The White House. Establishing the Task Force to Eliminate Fraud, Executive Order 14395 (March 16, 2026). https://www.whitehouse.gov/presidential-actions/2026/03/establishing-the-task-force-to-eliminate-fraud/

• U.S. Department of Health and Human Services. CMS Testimony on Combatting Medicare and Medicaid Fraud (March 17, 2026). https://www.hhs.gov/about/agencies/asl/testimony/2026/03/17/cms-testimony-on-combatting-medicare-and-medicaid-fraud.html

• Electronic Code of Federal Regulations. 42 CFR 424.515, Requirements for Reporting Changes and Updates to, and the Periodic Revalidation of, Medicare Enrollment Information. https://www.ecfr.gov/current/title-42/section-424.515

• Electronic Code of Federal Regulations. 42 CFR 424.516, Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status. https://www.ecfr.gov/current/title-42/section-424.516

• Electronic Code of Federal Regulations. 42 CFR 424.518, Screening Levels for Medicare Providers and Suppliers. https://www.ecfr.gov/current/title-42/section-424.518

• Electronic Code of Federal Regulations. 42 CFR 424.535, Revocation of Enrollment in the Medicare Program. https://www.ecfr.gov/current/title-42/section-424.535

• Electronic Code of Federal Regulations. 42 CFR 424.540, Deactivation of Medicare Billing Privileges. https://www.ecfr.gov/current/title-42/section-424.540

• Electronic Code of Federal Regulations. 42 CFR 455.414, Revalidation of Enrollment. https://www.ecfr.gov/current/title-42/section-455.414