Recredentialing vs Revalidation: Four Clocks, Not One

Recredentialing is one obligation and four clocks

Ask a practice when its recredentialing is due and you usually get one date. The obligations that keep a provider in network are four, they renew on different schedules, and no single party owns them all. Put them on one timeline and three of them stop being visible.

The Medicare revalidation cycle belongs to CMS. Each health plan’s recredentialing cycle belongs to that plan, working under a standard NCQA sets. The attestation and data maintenance on the profile payers pull from belongs to the profile company. Underneath all three sits the license, DEA registration and malpractice file, and each of those documents is owned by whoever issued it.

The traps are practical. A practice that tracks the plan’s cycle and ignores the CMS cycle keeps its network contracts and loses Medicare billing privileges. A practice that tracks both and lets the profile lapse stalls every application that depends on it, and no letter arrives to explain why.

Clock one: Medicare revalidation runs on the CMS cycle

CMS states that providers and suppliers generally revalidate every five years, that DMEPOS suppliers revalidate every three, and that it reserves the right to request off-cycle revalidations. The regulation behind the cycle is 42 CFR 424.515, which gives a provider 60 calendar days to respond once CMS notifies it to resubmit and certify its enrollment information.

CMS does not hide the date. It publishes revalidation due dates seven months in advance, and the enrollment contractor sends a notice three to four months before the due date. CMS tells providers to revalidate once they are within three months of their date, and warns that an unsolicited revalidation submitted more than seven months early will be returned unprocessed.

None of those deadlines is the revalidation cycle, and that distinction is the reason to keep the clocks apart. The five-year date is one trigger. A move, a sale, an adverse action or an unreturned request for information is another, and CMS can act on any of them between cycles.

Clock two: the plan’s recredentialing cycle belongs to the plan

NCQA sets the outer bound. Its credentialing standards require recredentialing every three years, and accredited plans build their own cycles inside that ceiling. The plan still owns the date. Aetna’s provider manual says a participating provider must be recredentialed every three years unless state regulations, federal regulations or accrediting standards require otherwise, which is the manual saying its cycle can run shorter.

The Highmark provider manual states that network practitioners are recredentialed at least every three years and that the cycle is consistent with NCQA, CMS and the state standards Highmark answers to. The same manual states that all network providers must use CAQH ProView for recredentialing, and that paper applications and portal functions for it have been eliminated.

The date is personal, not shared. A plan’s cycle runs from its last credentialing decision on that provider, so a group credentialed over several years carries staggered due dates. A practice holding one calendar entry for recredentialing is usually wrong about most of its providers.

Clock three: the profile attestation belongs to the profile company

Most commercial payers pull credentialing data from a shared profile rather than collecting it themselves. DataSpring, the company that publishes what CAQH used to, states the rule: attest every 120 days, or every 180 days for providers who practice in Illinois, and a provider who does not attest inside that window has their status changed to Expired.

What the attestation controls is access. DataSpring states that profile extracts include only providers who have attested since the last extract was received, so a plan pulling after your attestation lapsed does not receive a stale copy with a warning attached. You are absent from that update, and the file the plan was building stops moving.

This clock is short enough to catch a practice out three times a year, and it is the quietest of the four, because the lapse produces a stalled file rather than a denial. The field-level failures that block an attestation are covered in keeping a CAQH profile from blocking enrollment.

Clock four: the license, DEA and malpractice file underneath all of them

The fourth clock is not a cycle. It is a set of documents with expiration dates, each owned by the body that issued it, and every other clock reads from it. A credentialing committee cannot approve a file with an expired license, and Highmark’s credentialing criteria list an active DEA certificate and minimum malpractice coverage as conditions of staying in the network.

Each document renews on a schedule its issuer sets, and none of those schedules matches the others. A license renewal, a new malpractice carrier, or a registration that lapses and restarts can all change the data on your profile, which makes a document change a trigger for every clock at once.

When one clock lapses and the other three are current

A provider is licensed, enrolled with Medicare, attested on the profile and fully documented, and a commercial plan’s recredentialing date passes because nobody owned it. Nothing about the provider’s qualifications is in question. The participation status is, and participation is what pays the claim.

The first thing that changes is how a claim processes. A claim from a provider who is no longer participating in that network is still adjudicated, but at out-of-network rates or as a denial. X12’s current code list defines CARC 242 as services not provided by network or primary care providers, and its notes record that code 38, the older wording for the same situation, stopped on January 1, 2013 and was replaced by 242 and 243.

A network-status denial is not a coverage denial, and the two get worked by different people. CARC 27, expenses incurred after coverage terminated, is about the patient’s plan ending on a date of service. A network-status denial is about the provider’s participation ending. One is an enrollment fix, and the other is a benefits question.

What reinstatement requires depends on which clock lapsed. For Medicare, 42 CFR 424.540 says reactivation requires the provider to recertify that its enrollment information is correct, furnish missing information and comply with enrollment requirements, and CMS may require a complete CMS-855 application instead. The effective date of reactivation is the day the contractor received the submission it processed to approval, and the same section prohibits payment for services furnished while deactivated.

That reach-back is short and it is written down. The only retrospective billing period Medicare allows a physician is the one in 42 CFR 424.521: up to 30 days before an enrollment effective date when circumstances precluded enrolling first, and up to 90 days when a Presidentially declared disaster did. It applies to an initial enrollment effective date, not to a reactivation.

Commercial payers write their own rule, and finding that rule is the job. Highmark’s manual states that a practitioner terminated during recredentialing must undergo initial credentialing to return if the break in service or contract is greater than 30 days. It also states that if verification cannot be completed within 120 days, the applicant re-signs and re-dates the attestation page. Both numbers are Highmark’s.

The decision belongs to the owner. For Medicare, a Medicare Administrative Contractor processes the reactivation. For a commercial payer, the credentialing committee decides under the plan’s criteria, and Highmark’s manual describes reconsideration and appeal routes for that decision. A practice cannot negotiate the date. It can only file the paperwork that starts it.

One calendar with four columns, reviewed on a fixed cadence

The calendar that prevents all of this has one row per obligation per provider and four columns: the obligation, its owner, the trigger date and the evidence that it was completed. Nothing else is required, and nothing can be dropped from a row without leaving a visible hole.

1. 01

   List the obligations, one row each

   Medicare revalidation, each plan’s recredentialing, the profile attestation, and each underpinning document. Never merge them into a single row per provider.

2. 02

   Name the owner in the row

   CMS, the plan, the profile company, the issuing board or the carrier. An obligation with no name against it is the one that lapses.

3. 03

   Write the trigger date, not the anniversary

   The last credentialing decision for a plan cycle, the last attestation date for the profile, the document’s own expiration for the file. CMS publishes its dates.

4. 04

   Attach the evidence

   The submitted revalidation, the approval letter, the attestation confirmation, the current certificate. Evidence answers a payer’s request without a search.

Then review on a fixed cadence rather than when something breaks. A monthly pass over rows with a trigger date inside the next 120 days covers the profile and the document clock, and it surfaces the plan and CMS dates while there is still time to file.

Two habits keep the rows honest. Confirm every effective date in writing before you bill against it, and confirm that the payer’s provider record is loaded, because a committee approval is not the same thing as an active record in the claims system. The credentialing timeline breaks that sequence into its stages, and the Medicare side has its own walkthrough.

We run all four clocks for clients through medical credentialing services, alongside medical billing and denial management. Send us your provider list and your payer contracts and we will build the rows.

Questions practices ask us about this