For most of the past two decades, Medicare provider enrollment ran through a system that worked, just barely. PECOS, the Provider Enrollment, Chain, and Ownership System, served as the official portal for every CMS-855 application, every revalidation, and every change of information. It accepted submissions, routed them to Medicare Administrative Contractors, and returned approvals weeks or months later. It was clunky, paper-flavored, and forgiving in ways that don’t survive in 2026.
CMS launched PECOS 2.0 in late 2025 and full migration is rolling out to every Medicare-enrolled provider through the end of 2026. This is not a cosmetic update. It’s a complete rebuild of the enrollment infrastructure, with real-time data validation, automated cross-referencing against IRS and federal databases, stricter identity verification, and new enforcement authority that lets CMS revoke enrollments retroactively for compliance gaps.
PECOS is the Medicare piece of the larger provider credentialing process. This post focuses on what changed in the new system; the complete guide covers how Medicare enrollment fits alongside commercial and Medicaid credentialing.
For practices that have run Medicare enrollment cleanly for years, PECOS 2.0 introduces a new failure mode. Discrepancies that stayed invisible in the old system now get caught instantly, flagged as “Stay of Enrollment,” and freeze payments while CMS investigates. Practices that prepared before their migration are seeing faster processing and fewer disruptions. Practices that didn’t are getting surprise notices about data they didn’t realize was wrong.
This post walks through what PECOS 2.0 actually changed, what’s already costing practices revenue in 2026, and what to do before your enrollment migrates.
What PECOS 2.0 Actually Is
PECOS 2.0 is CMS’s complete rebuild of the Medicare enrollment system, replacing the old form-filling portal with a system that validates your data in real time against federal databases. Development began in 2023, pilot testing ran through select Medicare Administrative Contractors in 2025, and the production system rolled out in phases beginning in late 2025. Full migration of every Medicare-enrolled provider is scheduled to complete by the end of 2026.
The old PECOS was essentially a digital form-filling exercise. Providers entered data field by field, uploaded supporting documents, and waited for a human reviewer at the MAC to verify everything against external sources. MAC reviewers often caught errors weeks later, forcing resubmission and pushing effective dates further out.
PECOS 2.0 changes the foundation. The new system pre-populates data from existing CMS records and the NPI registry, reducing manual entry. Real-time validation runs against IRS, NPPES, EFT, and other federal databases as you type. Cross-referencing checks ownership disclosures against banking and corporate records. Multi-factor authentication is now required for every login through CMS’s Identity and Access (I&A) Management framework. Sequential application completion means incomplete submissions can’t move forward. Discrepancies surface immediately rather than after MAC review.
The result: more applications approved cleanly the first time, but also more applications stopped at submission because of issues the old system would have let through.
When Will My Practice Migrate?
Migration runs in phases through the end of 2026, and CMS notifies each provider before their enrollment moves to the new system. You don’t choose your migration date, and you can’t opt out. Every Medicare-enrolled provider will be on PECOS 2.0 by the end of 2026.
The practical takeaway: you may not know your exact migration date until CMS notifies you, so the safe assumption is that it could happen soon. The preparation work below is worth doing now rather than waiting for the notice, because once migration starts, any existing data problems surface immediately and can freeze payments before you’ve had a chance to fix them.
The Changes That Matter Most for Practices
Five structural changes in PECOS 2.0 are reshaping how practices handle Medicare provider enrollment in 2026.
Real-Time Cross-Referencing With Federal Databases
PECOS 2.0 checks every field you enter against the authoritative source instantly, rather than trusting your input and verifying later. This is the most consequential change in the new system.
Your legal business name has to match your IRS CP-575 or 147C letter character-for-character. Your NPPES record has to match your PECOS submission exactly on name, address, taxonomy, and contact details. Your EFT banking information has to match the financial institution’s records. Your ownership disclosures have to align with what’s filed in your IRS and corporate records.
In the old system, minor discrepancies between systems were common and resolved over time through development letters. In PECOS 2.0, those discrepancies trigger immediate flags. A practice address that reads “Suite 200” in one system and “Ste. 200” in another can stall an application before it ever reaches a MAC analyst.
Identity and Access (I&A) Management With MFA
Every PECOS 2.0 user must now log in through CMS’s Identity and Access Management system with multi-factor authentication. The old PECOS used simple username/password access. PECOS 2.0 requires a verified identity tied to a federal credential, MFA on every login, and role-based permissions for organizational users.
For solo providers, this is mostly a one-time setup. For groups and credentialing teams managing multiple providers, the I&A structure adds complexity. Each user must have their own credential. Surrogate users (credentialing companies, billing services, or staff members acting on behalf of providers) must go through formal authorization in I&A.
The practical issue: practices that lost track of who has PECOS access often discover during migration that the credentialing coordinator who set everything up three years ago has left, and nobody else has working credentials. Recovering access to a migrated PECOS 2.0 account requires identity verification that can take days or weeks.
Stay of Enrollment Mechanism
A Stay of Enrollment is a payment freeze that PECOS 2.0 applies automatically when its validation finds a discrepancy in your record. This is the new enforcement mechanism catching practices off guard. The provider’s enrollment goes under review, payments stop, and claims sit pending until someone resolves the issue.
Stay of Enrollment differs from deactivation or revocation. It’s a pause, not a termination. But the financial impact runs the same in the short term: revenue stops until the discrepancy resolves, which can take 30 to 90 days depending on the complexity of the issue and the MAC’s queue.
The most common triggers in early 2026 migrations: address inconsistencies between PECOS and NPPES, taxonomy code mismatches, expired licenses that the old system would have given grace on, and ownership disclosures that no longer match current corporate records.
Expanded Revocation Authority
CMS can now revoke a Medicare enrollment retroactively and recoup payments already made, under rules that took effect January 1, 2026. The CY 2026 HHA PPS Final Rule gave CMS retroactive revocation authority, shortened the adverse legal action reporting window to 30 days for most changes, and expanded deactivation authority to providers with 12 months of inactivity.
The most painful of these is retroactive revocation. Under the new rules, if CMS later determines a provider should have been revoked at an earlier date, they can revoke the enrollment back to that earlier date and recoup Medicare payments made in the interim. A provider who kept billing while a compliance issue sat unresolved can owe back months of revenue.
The 30-day reporting window matters too. Adverse legal actions, ownership changes, and most enrollment-affecting events used to follow varying reporting windows. PECOS 2.0 standardizes them to 30 days. Miss a reporting deadline and the new system catches it automatically.
AWS Cloud Migration
CMS is moving PECOS to AWS Cloud on May 4, 2026, which changes the IP addresses the system responds from. This infrastructure change happens alongside PECOS 2.0. For most practices it’s invisible, but for organizations that use IP allowlists to restrict outbound traffic to known CMS addresses, networks that block the new ranges will lose PECOS access until IT updates the allowlist.
If your practice’s IT team maintains a CMS allowlist, this needs to be on their radar for May 2026.
What’s Already Causing Problems in 2026 Migrations
A few months into broad PECOS 2.0 rollouts, recurring failure patterns are emerging. Each one has a specific fix worth knowing about.
Address Mismatches Triggering Stay of Enrollment
This is the single most common trigger. Practices that updated their address in NPPES but not in PECOS (or vice versa) are seeing automatic flags during migration. To fix this, reconcile every system before migration. NPPES, PECOS, CAQH, IRS records, EFT, and state Medicaid all need to show the same address in the same format.
Surrogate User Access Loss
Credentialing companies and billing services that had access to client PECOS accounts in the old system have to re-authorize under PECOS 2.0’s I&A framework. This is not automatic. Surrogate authorizations don’t transfer during migration. Practices using outsourced credentialing should confirm their vendor has re-authorized access in I&A before any urgent work needs to happen.
Expired Documents the Old System Tolerated
PECOS 2.0 validates document expirations in real time. A medical license that expired three months ago would have generated a development letter in the old system. Now it triggers a Stay of Enrollment immediately on the next interaction. Document tracking has to run tighter than it did before.
Ownership Disclosure Misalignment
Practices that changed entity structure (LLC to PC, partnership reorganization, ownership percentage changes) without updating PECOS within the required 30-day reporting window are getting caught now. The new validation cross-references corporate filings, so historical inconsistencies surface during migration even if everything looks current today.
Banking Information Mismatches
EFT enrollment data must match the financial institution’s records. Practices that changed bank accounts, restructured how payments come in, or have any inconsistency between the bank’s records and PECOS data are seeing payments freeze until reconciliation. This is one of the fastest revenue impacts of PECOS 2.0 errors.
Taxonomy Code Drift
Specialty designations that diverged between NPPES and PECOS over the years are getting flagged. A provider whose NPPES taxonomy reads family medicine but whose PECOS specialty designation reads something else (or vice versa) needs reconciliation before migration.
Preparing for Your PECOS 2.0 Migration
If your practice hasn’t migrated yet, the window for proactive cleanup is closing. Migrations continue through the end of 2026, and providers who prepare before their migration date see materially better outcomes than those who wait.
Here’s the practical preparation work, in priority order.
Audit Your Current PECOS Data
Log into your existing PECOS account and review every section for accuracy. Pay particular attention to legal business name, practice addresses, taxonomy codes, ownership disclosures, banking information, and license expiration dates. Anything wrong now will trigger an immediate flag during migration.
Reconcile Data Across Systems
PECOS, NPPES, CAQH, IRS records (CP-575 or 147C letter), EFT records, and state Medicaid all need to show the same data. This is the single highest-leverage preparation step. The full picture of how data flows between these systems lives in our CAQH ProView guide. The same reconciliation principles apply, just with PECOS as the central reference point.
Set Up Identity & Access Management Early
Don’t wait until you need PECOS access urgently to set up I&A. Each user who needs access — providers, credentialing coordinators, billing staff, outsourced credentialing vendors — should set up I&A credentials and test them before migration. This matters especially for organizations with surrogate user arrangements that need re-authorization under the new framework.
Update Your Document Calendar
PECOS 2.0’s real-time validation leaves less margin for document expirations. Track medical license, DEA, malpractice coverage, board certifications, and other credentialing documents with 60-day advance reminders. Lapses that the old system would have let slide are now immediate flags.
Verify Reporting Obligations Are Current
Adverse legal actions, ownership changes, or other reportable events from the past 30 days should show up in your PECOS record before migration. Practices that haven’t filed required updates are exposed under the new retroactive revocation authority.
Confirm Contact Information
PECOS 2.0 notifications go to the email address on file. If that address belongs to someone who left the practice, you’ll miss everything. Verify that the primary contact email is active and monitored.
Plan Around the May 2026 AWS Cutover
If your IT team uses IP allowlists for CMS traffic, add the new AWS IP ranges before May 4. You can prevent these outages entirely with a small amount of advance planning.
What This Means for Your Credentialing Operations
PECOS 2.0 doesn’t change the fundamentals of Medicare enrollment. You still file CMS-855I for individual providers, CMS-855B for groups, CMS-855R for reassignment of benefits, and CMS-855A for institutional providers. Revalidation cycles still run five years for most providers. The Medicare enrollment application fee still sits at $750 for institutional providers and DMEPOS suppliers, set under CMS MLN9658742.
What changes is the margin for error. The old PECOS forgave inconsistencies and gave you time to resolve them. PECOS 2.0 catches them in real time and enforces consequences immediately. Practices that have run loose credentialing operations — distributed ownership, no central data reconciliation, reactive rather than proactive — will find that the new system exposes problems the old system papered over.
The implications cascade through every credentialing function. The credentialing timeline for new providers gets tighter, because there’s less room for downstream corrections. Re-credentialing and revalidation require more data hygiene than before, because PECOS 2.0 flags issues that the old system absorbed. Group practice credentialing sees more failures at the reassignment step, because the I&A framework adds complexity to surrogate authorizations. Credentialing denial patterns shift, with data mismatches becoming an even larger share of total denials.
Practices that have been operating on the assumption that “PECOS will let us know if something’s wrong” need to flip the model. The new assumption: PECOS knows everything in real time, and any inconsistency is your problem to find and fix before it finds you.
When to Get Help
For solo providers with clean data and one practice location, PECOS 2.0 migration is mostly an administrative event. Set up I&A, verify your existing data, and let the system migrate you.
For groups, multi-location practices, and any practice with provider turnover, ownership complexity, or historical data drift, the migration runs harder. The data work alone — reconciling NPPES, PECOS, CAQH, IRS, EFT, and state systems — can take 20 to 40 hours of focused attention per provider, and that’s before any issues surface that require resolution.
Practices that outsource credentialing typically handle this work as part of the relationship. Practices that don’t should consider whether the cost of an outsourced credentialing partner is lower than the cost of a Stay of Enrollment that freezes Medicare payments for two months.
If you want a starting point, the free CredReady audit reviews your current PECOS, NPPES, CAQH, and document posture to flag the discrepancies most likely to trigger problems during PECOS 2.0 migration. It takes 15 minutes and produces a personalized PDF showing exactly where the risks sit.
Frequently Asked Questions
PECOS 2.0 is CMS’s rebuilt Medicare provider enrollment system, launched in late 2025. It replaces the old form-based portal with a system that validates provider data in real time against IRS, NPPES, EFT, and federal databases, requires multi-factor authentication, and flags discrepancies immediately rather than after manual review.
PECOS 2.0 began rolling out in late 2025, with migration happening in phases through the end of 2026. Every Medicare-enrolled provider will be on the new system by the end of 2026. CMS notifies each provider before their enrollment migrates, and the transition is mandatory.
The 2026 Medicare enrollment application fee is $750 for institutional providers and DMEPOS suppliers, applied to new enrollments, revalidations, and practice location changes. Individual practitioners enrolling through CMS-855I generally do not pay the institutional application fee.
A Stay of Enrollment is a payment freeze that PECOS 2.0 applies when its validation finds a discrepancy in a provider’s record. The provider stays technically enrolled but cannot bill until the issue is resolved. It differs from deactivation or revocation in that it’s a temporary pause, but it can still stop revenue for 30 to 90 days while the discrepancy is corrected.
Audit your current PECOS data for accuracy, reconcile it against NPPES, CAQH, IRS, EFT, and state Medicaid records so everything matches exactly, set up Identity & Access (I&A) credentials with multi-factor authentication for everyone who needs access, track document expirations with 60-day reminders, and confirm your contact email is current. Practices that clean up data before migration avoid most Stay of Enrollment flags.
Don’t Let PECOS 2.0 Catch You Off Guard
PECOS 2.0 is the largest structural change to Medicare provider enrollment in two decades. The transition is mandatory, the timeline runs through the end of 2026, and the practices that prepare proactively are seeing materially better outcomes than those that wait for migration to find their problems.
MedBillingTech handles Medicare provider enrollment, revalidation, and ongoing PECOS maintenance for solo providers, group practices, and credentialing teams across all 50 states. Flat fee of $150 per application with PECOS 2.0 setup, data reconciliation, I&A authorization, and ongoing monitoring included. Sixteen-plus years of payer enrollment experience.
Get Started With Credentialing →
Or call (512) 254-3133 to talk through where your PECOS data currently stands and what needs attention before migration.
