Medicare Credentialing Requirements: Full Checklist for 2026

Which CMS-855 form do you need?

The right CMS-855 form depends on what's being enrolled: an individual practitioner, a group practice, an institutional provider, an ordering or referring provider only, a DMEPOS supplier, or an MDPP supplier. Each provider type maps to one form.

PECOS 2.0 is the system of record. CMS modernized PECOS in 2023-2024 with real-time validation, cross-referencing against IRS, NPPES, OIG, and SAM, and a streamlined interface. Minor data inconsistencies that previously slipped through now trigger immediate flags, so application accuracy matters more than it used to.

There are some edge cases worth knowing:

• Sole owners of a single-shareholder professional corporation file the CMS-855I for both the provider and the entity. A separate 855B isn't needed.
• Partnerships and multi-owner groups file the CMS-855B for the entity and a CMS-855I for each provider.
• Providers joining an existing enrolled group complete the 855I (if they're not already enrolled) and report the reassignment in the same form.
• Providers who only order, certify, or refer Medicare items or services without ever submitting claims (for example, dentists who order labs for Medicare patients, VA-employed physicians, or residents and fellows who write referrals) file the 855O instead of the 855I.

All current 855 forms are available on the CMS forms page.

The complete Medicare credentialing document checklist

Every CMS-855 submission needs the same five categories of documentation: identification and licensure, business and tax records, banking, professional history, and the required companion forms. Build a standing credentialing file with each item below and the application packet comes together fast.

Identification and licensure

• NPI (National Provider Identifier). Type 1 for individuals, Type 2 for organizations. Issued through NPPES. Every Medicare claim is rejected without one.
• Active state medical license for every state where the provider sees patients. Telehealth providers need a license in the state where the patient is located during the visit.
• DEA certificate, if the provider prescribes controlled substances.
• Board certifications, if applicable to the provider's specialty.
• ECFMG certificate, for foreign medical graduates. Not required for NPs, PAs, or CNMs.
• Government-issued photo ID for identity verification.

Business and tax

• IRS CP-575 or Letter 147C confirming the legal business name and EIN. The name on this letter is the name Medicare matches against everything else. Any discrepancy triggers a rejection.
• Articles of incorporation or equivalent organizational documents, for group practices and institutional providers.
• State business license or zoning permit, if required in the practice's jurisdiction.

Banking

• Voided check or bank confirmation letter on official bank letterhead. Medicare pays only by electronic funds transfer, so this is mandatory.
• The name on the bank account must match the legal business name on the application and on the IRS CP-575 exactly. Suffixes matter. "Smith Medical LLC" is not the same as "Smith Medical Inc." on a Medicare application.

Professional history and credentials

• Curriculum vitae covering complete work history. Gaps over six months need a written explanation.
• Education and training records: medical school, residency, fellowship.
• Malpractice insurance certificate showing carrier, coverage amounts, and effective dates.
• Malpractice claims history, if any.
• Disclosure of any adverse legal actions: license revocations, suspensions, exclusions, felony convictions, or terminations from other federal healthcare programs.

Required companion forms

Two forms typically accompany a CMS-855 submission:

• CMS-588 (Electronic Funds Transfer Authorization Agreement). Required because Medicare pays only by EFT. Must include the voided check or bank letter described above. Name mismatches here are the single most common cause of EFT rejection.
• CMS-460 (Medicare Participating Physician or Supplier Agreement). Optional but consequential. Filing it elects participating status, which binds the provider to accept assignment on all Medicare claims and typically results in higher reimbursement and direct payment. Skipping it means non-participating status, with different payment rules.

Most rejections trace back to two things: name mismatches across the application, IRS record, and bank documentation, or missing signatures on paper filings. A standing credentialing file with every document scanned, dated, and named consistently turns the next revalidation or new-payer enrollment into a copy-and-attach job instead of a scavenger hunt.

The 2026 Medicare enrollment application fee

The 2026 enrollment fee is $750, adjusted annually based on the Consumer Price Index. The fee applies to most institutional providers and suppliers, not individual practitioners.

Who pays the fee in 2026:

• Institutional providers filing the CMS-855A
• Certain CMS-855B filers that aren't physician or non-physician practitioner (NPP) organizations, including ambulance suppliers, independent diagnostic testing facilities (IDTFs), portable X-ray suppliers, and mammography centers
• DMEPOS suppliers filing the CMS-855S
• Opioid treatment programs
• New practice locations for institutional providers

Per 42 CFR 424.502, the definition of "institutional provider" for fee purposes covers any provider or supplier submitting the CMS-855A, CMS-855B (excluding physician and NPP organizations), or CMS-855S.

Who is exempt:

• Physicians, non-physician practitioners, and physician organizations
• MDPP suppliers

The fee is paid during the PECOS application flow or through pay.gov for paper filers. A hardship exception is available for providers enrolling in geographic areas under a Presidentially declared disaster, requested by letter alongside the enrollment application.

One detail that catches reactivating providers off guard: when an institutional or DMEPOS enrollment is deactivated for a missed revalidation, reactivation requires a new full application and triggers the $750 fee a second time.

How long does Medicare credentialing take

CMS targets 15 days for 95% of clean PECOS applications, 30 days for paper applications without a site visit, and 65 days for paper applications with a site visit.

In practice, actual processing typically runs 30-60 days for PECOS and 60-120+ days for paper, depending on the Medicare Administrative Contractor (MAC) reviewing the file. Novitas, Palmetto, Noridian, WPS, and others each operate at slightly different speeds.

A few timing rules shape how practices schedule new providers:

• Retroactive billing. Under 42 CFR § 424.521, providers who met all program requirements may bill retroactively up to 30 days before the application receipt date, 90 days under a Presidentially declared disaster. Seeing patients before submitting forfeits anything beyond that window.
• MAC requests for additional documentation. If the MAC requests additional information, the applicant has 30 days to respond. Miss it and the application is rejected.
• Resubmission delay. A rejected application restarts the timeline. Each correction cycle commonly adds several weeks to a few months, depending on MAC workload and how quickly the applicant responds.

PECOS submissions process faster than paper for a reason. The system flags missing fields and inconsistent data before the application reaches the MAC, which removes one of the most common causes of rejection.

After approval: ongoing Medicare credentialing requirements

Medicare enrollment is not a one-time event. CMS requires enrolled providers to revalidate on a fixed cycle, report specific changes within tight deadlines, and stay continuously eligible. Each has a distinct mechanism and a distinct consequence for missing it.

Revalidation

Revalidation is the scheduled renewal of Medicare enrollment. Most providers and suppliers revalidate every five years. DMEPOS suppliers revalidate every three years. CMS also reserves the right to request off-cycle revalidations.

How it works:

• The MAC sends a revalidation notice 2-3 months before the due date, by email and postal mail to the addresses on file.
• Providers are responsible for tracking their own revalidation due dates regardless of whether the notice is received. Due dates are published on the Medicare Revalidation List about seven months in advance.
• Submission goes through PECOS in nearly all cases.
• Missing the deadline triggers deactivation of Medicare billing privileges, typically within 60 to 75 days.

Reactivation requires recertifying that enrollment information on file is correct and furnishing any missing information. CMS or the MAC may also require a full new CMS-855, which is standard for missed-revalidation reactivations.

For applications received on or after December 19, 2023, a 30-day retroactive billing window can apply. Services delivered outside that window during the lapse won't be paid.

Under 42 CFR § 424.516, certain changes must be reported to the MAC within 30 days of the event, independent of the revalidation cycle:

• Change of ownership or control, including changes in authorized or delegated officials
• Change, addition, or deletion of a practice location
• Final adverse legal actions, including license revocations, suspensions, or exclusions

All other changes to enrollment must be reported within 90 days.

The 30-day clock catches practices that treat revalidation as the only update opportunity. By the time the next cycle arrives, years of unreported changes can surface in one application, and MAC responses are rarely sympathetic.

Retroactive revocation

Under 42 CFR 424.535(g), revocation effective dates can be retroactive in specific situations, including:

• A felony conviction (effective the date of conviction)
• A state license suspension, revocation, or surrender in lieu of disciplinary action (effective the date of the action)
• A federal exclusion or debarment (effective the date of the exclusion or debarment)
• A determination that the practice location is non-operational
• Termination from another federal health care program such as Medicaid (effective the date of termination)

The practical exposure: when revocation is retroactive, Medicare can recoup payments already made for services delivered after the effective date. Providers may also face a re-enrollment bar of one to ten years, with up to 20 years on a second revocation under 42 CFR 424.535(c).

This is the clearest argument for treating Medicare enrollment as ongoing operational work rather than an enrollment milestone. The 30-day and 90-day reporting clocks aren't bureaucratic suggestions.

Common mistakes that delay or deny applications

Most Medicare enrollment rejections are caused by procedural or timing errors. The patterns are consistent across MACs:

• Stamped signatures on paper filings. CMS requires original ink signatures on every paper 855. Stamped signatures are invalid and the entire packet is returned.
• Outdated form versions. CMS revises the 855 forms periodically. Submitting the prior version is grounds for rejection even if the data is complete.
• Failing to disclose adverse legal actions. Undisclosed adverse actions discovered during MAC review trigger denial and can affect future enrollment eligibility.
• Stale PECOS correspondence address. When the email or postal address in PECOS is out of date, the revalidation notice (sent 2-3 months before the due date per CMS) goes to the wrong inbox. Providers regularly discover they were deactivated months earlier.
• Applying after the provider's start date. Retroactive billing covers up to 30 days before application receipt. A new provider seeing patients six weeks before the application is filed loses two of those weeks; anything beyond the 30-day retroactive window is unbillable Medicare revenue.
• Inconsistent data across NPPES, PECOS, and the application. The MAC and PECOS 2.0 cross-reference application data against NPPES, the IRS, OIG, and SAM. A different practice address or specialty taxonomy across systems triggers a request for clarification at best and a rejection at worst.

A standing pre-submission checklist that covers form version, signatures, address consistency, and PECOS contact information closes most of these gaps before they reach the MAC.

Medicare is the first credentialing step

Medicare enrollment is the first credentialing step a practice takes. The same documents and the same discipline carry through CAQH, commercial payer enrollment, Medicare Advantage credentialing, and the revalidation cycles each payer runs on its own schedule.

Teams that scale this work well separate what genuinely needs human judgment, like form selection and exception handling, from what's just repeated portal work across payers.

Tools like Kaizen exist for the second category, automating the multi-payer credentialing, maintenance, and status-tracking work where the same actions repeat across dozens of portals. PECOS itself stays with the team.

If credentialing across CAQH, Availity, and payer portals is eating your ops capacity, book a call to see how plain-English automation handles the repeat work.

Frequently asked questions

Is PECOS the same as Medicare credentialing?

No, PECOS isn't the same as Medicare credentialing. PECOS is the online system CMS uses to process applications, while Medicare credentialing is the underlying enrollment process that includes the CMS-855, CMS-588, CMS-460, and supporting documents.

What's the difference between Medicare credentialing and Medicare enrollment?

The main difference between Medicare credentialing and Medicare enrollment is scope: enrollment is the formal CMS process of submitting the CMS-855 and getting approved to bill Medicare, while credentialing is the broader process of verifying a provider's qualifications, which payers (including Medicare) use to grant billing privileges.

How often do you have to revalidate with Medicare?

Most providers and suppliers revalidate every five years, and DMEPOS suppliers revalidate every three years. CMS can also request off-cycle revalidations, and missing a deadline causes deactivation with no retroactive payment recovery.

Can you bill Medicare retroactively before approval?

Yes, Medicare may permit retroactive billing for up to 30 days before the application receipt date when circumstances precluded earlier enrollment. Up to 90 days is permitted under a Presidentially declared disaster, but services delivered before that window can't be billed once enrollment is approved.