Most practices that lose revenue to credentialing problems don’t lose it at the start. They lose it three years in, on a Tuesday, when claims start bouncing back and nobody can figure out why. By the time someone traces it back to a missed re-credentialing deadline, the damage is two weeks deep and the recovery path is not a quick fix. It’s a full re-enrollment cycle.
This is the part of credentialing nobody plans for. The initial process gets attention because it has a start date and a goal: get the new provider live. Re-credentialing has neither. It just exists, somewhere on someone’s calendar, until the deadline arrives and the inbox where the notice was sent doesn’t get checked.
If you’ve been through credentialing once, you already know how long it takes. What follows is what happens when you forget to do it again.
What Re-Credentialing Actually Is
Re-credentialing is the periodic re-verification of everything that was verified during initial credentialing: license, DEA, board certification, malpractice coverage, work history, sanctions, and disciplinary actions. The payer (or the credentialing verification organization working on its behalf) goes back to primary sources and confirms that nothing has changed in a way that would disqualify the provider from continuing to participate in the network.
It is not a paperwork exercise. It is the network’s mechanism for catching license suspensions, malpractice judgments, OIG exclusions, and adverse actions that happened between the last credentialing decision and now. Every re-credentialing cycle is a clean re-verification.
The cycles are not negotiable. They are not approximate. The phrase “every three years” in NCQA’s standards does not mean “around three years.” NCQA requires re-credentialing every 36 months from the last approval date, exactly 36 months, and they treat it as a hard deadline during audits. Informal tracking does not count as a documented process.
The Cycle Lengths You Actually Need to Track
Different payers run different clocks. A provider participating in Medicare, three commercial plans, and a state Medicaid program is on at least four separate timelines, none of which align.
NCQA-aligned commercial payers: 36 months. This covers most major commercial insurers. BCBS plans, UnitedHealthcare, Aetna, Cigna, Humana, and almost any payer that pursues NCQA accreditation runs on the 36-month cycle. The clock starts on the date of the last credentialing committee approval, not the application date or the contract effective date.
Medicare: 5 years for most providers, 3 years for DMEPOS suppliers. CMS revalidates Medicare enrollment every five years through PECOS, with DMEPOS suppliers on a tighter three-year cycle. CMS posts revalidation due dates seven months in advance on the Medicare Revalidation Lookup tool, and your Medicare Administrative Contractor sends a notice two to three months before the due date.
Medicaid: varies by state. Most states follow the federal five-year framework for Medicaid revalidation, but some run shorter cycles, and the application processes and documentation requirements differ from one state to another. Multi-state telehealth providers are running multiple Medicaid cycles in parallel, with different deadlines in each state.
Hospital privileging: 24 months. The Joint Commission and most hospital medical staff offices re-privilege every two years, separate from payer credentialing.
CAQH attestation: every 120 days. This is not a re-credentialing cycle, but it is the deadline that breaks more credentialing programs than any other. CAQH ProView requires providers to re-attest to the accuracy of their profile every 120 days. An expired attestation freezes commercial payer access to the profile, which means even if your formal re-credentialing isn’t due, your CAQH-dependent payer relationships pause until you re-attest.
A solo provider in a single state with Medicare, Medicaid, and four commercial payers has six independent cycles to track. A group practice with twelve providers across two states is tracking dozens. The math gets bad fast.
What Happens When You Miss It
This is where the cost lives. Missing re-credentialing is not a paperwork inconvenience. It is a network termination event with direct revenue consequences.
Commercial payer lapses. When a commercial payer’s re-credentialing window closes without action, the provider is removed from the network. Claims submitted after the termination date are denied as out-of-network. The reinstatement path is not a fast-track renewal; it is a full new credentialing cycle, which on the commercial side runs 60 to 120 days. During that period, the provider is out of network.
Medicare deactivation. If a Medicare revalidation deadline passes without a submitted application, CMS deactivates billing privileges 60 to 75 days after the due date. Once deactivated, the provider must re-enroll with Medicare from scratch. This is the consequence that hurts the most: Medicare does not pay for services rendered during the deactivation gap, and there is no retroactive billing allowed. A provider can see Medicare patients in good faith for weeks, and every claim from that period is uncollectible.
The first sign for most practices is not the deactivation notice. It is denied claims showing up in the AR aging report. By the time the cause is identified, two to four weeks of Medicare revenue is already at zero recoverability. For a practice where Medicare represents 30% of payer mix, that’s a meaningful hit.
CAQH lapses. When attestation expires, commercial payer access to the profile pauses. Re-credentialing applications in progress freeze until the attestation is renewed. New payer applications cannot be processed. The practical effect is that CAQH becomes the choke point: a single missed attestation deadline can stall every commercial credentialing activity at once.
Patient panel disruption. Beyond the revenue, there is the operational mess. Patients with appointments are reassigned or canceled. Referrals stop arriving. Online provider directories list the provider as unavailable. Once a practice has explained to a patient that “we just need to get some paperwork resolved,” the credibility cost has already been paid.
The 2026 environment makes all of this harder, not easier. NCQA tightened standards in July 2025: primary source verification windows shrunk from 180 days to 120 days for accreditation and 90 days for certification, monthly monitoring is now required against OIG, SAM.gov, and state Medicaid exclusion databases, and notification windows for credentialing decisions tightened to 30 days. The new standards punish reactive programs and reward continuous monitoring.
Why Re-Credentialing Gets Forgotten
The pattern is consistent across practices that lose revenue to lapses. It’s not that credentialing is too complex. It’s that the work has no natural prompt.
The initial credentialing process is forced into someone’s attention because the new provider has a start date. Everyone knows when day one is. Re-credentialing has no equivalent. The deadline lives on a server somewhere, in a payer’s notification system that defaults to whatever email address was on the application three years ago. If that email belonged to a billing manager who left two years ago, the notice arrives in an inbox nobody checks.
The other failure mode is distributed responsibility. In practices without a designated credentialing coordinator, re-credentialing gets handled by whoever has time. When that person is also handling claims, denials, and patient calls, the long-dated administrative work loses to whatever is on fire today. Three months of “I’ll get to it next week” turns into a missed deadline.
The third failure mode is provider attestation drift. CAQH requires the provider, not the staff, to attest. If the provider doesn’t get the email, doesn’t recognize what it’s asking for, or assumes the office handles it, attestations expire silently. The 120-day window is short enough that one missed cycle of communication breaks the chain.
None of these failure modes are about skill. They are about infrastructure. Re-credentialing programs that work share a small set of structural choices.
What Working Re-Credentialing Programs Do Differently
A handful of patterns separate practices that never miss a deadline from those that lose weeks of revenue every cycle.
Start 120 days early, not on the deadline. Industry guidance is to begin re-credentialing 90 to 120 days before the renewal date. The 90-day floor exists because primary source verification, committee review, and contract execution take time, and any of those steps can hit a delay that consumes the buffer. Practices that start at the deadline lose the buffer entirely. By the time a development letter arrives requesting clarification, the cycle is already late.
Track every provider against every payer in one place. A spreadsheet is enough if it’s maintained. The columns that matter: provider name, payer, last credentialing date, next due date, CAQH attestation date, Medicare revalidation date, current status, and last action taken. Distributed tracking across emails, payer portals, and individual memory does not survive contact with a busy quarter.
Designate one owner. Re-credentialing fails when accountability is shared. One person at the practice should be responsible for the calendar of every renewal, every attestation, and every payer status. That person can be internal or external, but the accountability has to be unambiguous. Whoever it is should be able to answer, on any given Wednesday, exactly when the next deadline hits and what action is required.
Verify contact information annually. The most preventable category of missed deadlines comes from notification emails going to addresses nobody monitors. Once a year, log into PECOS, CAQH, and every commercial payer portal and confirm that the contact email and address on file are current. Fifteen minutes per provider per year prevents the most common cause of catastrophic lapses.
Treat CAQH attestation as a quarterly task. The 120-day window means attestation comes due roughly every four months. Build it into a calendar with reminders at day 90 and day 105. When multiple providers are in the practice, stagger reminders so the work isn’t all in one week.
Monitor between cycles. The 2025 NCQA standards now require monthly checks against OIG, SAM.gov, and state Medicaid exclusion databases. For practices that don’t run a delegated credentialing program, this is still good practice. A sanction or exclusion that surfaces between cycles becomes a much bigger problem if it isn’t caught until the next re-credentialing review.
Audit your data integrity quarterly. Inconsistencies between PECOS, NPPES, CAQH, and internal records are among the most common payer audit triggers. A name format that’s “John Q. Smith” in NPPES but “John Quincy Smith” in PECOS will eventually cause an issue. Reconciling these systems quarterly is cheaper than fixing the failure mode later.
A Realistic Re-Credentialing Calendar
The structure that works for most practices, scaled to the number of providers and payers:
Day -120 to -90 before deadline: Start the process. Pull current documents (license, DEA, malpractice COI, board certifications). Confirm CAQH profile is current and attested. Submit re-credentialing application or revalidation through the appropriate channel.
Day -90 to -45: Monitor application status weekly. Respond to any payer development letters within 48 hours. Verify that primary source verification is in progress.
Day -45 to -15: Confirm committee review scheduling. For Medicare, confirm PECOS shows the application as accepted and in process. For commercial payers, confirm receipt and expected decision date.
Day -15 to 0: Final confirmation that approval is on track. If a payer is running late, escalate through the payer’s credentialing contact. Do not wait until after the deadline to identify a problem.
Day 0 (deadline): Approval should be in hand. Update internal records. Verify directory listings, EFT setup, and contracted fee schedules are current.
Between cycles: Monthly OIG, SAM.gov, and state Medicaid exclusion checks. Quarterly CAQH attestation. Annual contact information verification across all systems.
This is not a complicated process. It is just a process that has to actually happen, on a schedule, with someone who owns it. Most practices that lose revenue to re-credentialing are not failing because the work is hard. They are failing because nobody scheduled it.
When Outsourcing Makes Sense
For practices with one or two providers and two or three payers, a designated internal coordinator with a maintained spreadsheet is enough. For everyone else, the math starts favoring an outsourced credentialing partner around the point where the number of cycles to track exceeds what one person can hold accurately.
What an outsourced partner provides is not faster payer responses. Payers respond at the speed they respond, and no vendor changes that. What outsourcing provides is the calendar discipline: tracking, advance starts, document collection, attestation reminders, and follow-up that doesn’t drop because the person responsible got pulled into a different fire.
If you want a sense of what the initial credentialing timeline looks like (and why the same discipline applies on the renewal side), the credentialing timeline guide walks through the 90-day cycle in detail. Re-credentialing is the same work, on a different clock, with higher stakes if it slips.
Don’t Let a Missed Deadline Cost You Months of Revenue
Re-credentialing is one of the highest-leverage administrative functions in a healthcare practice. When it works, nothing happens. When it fails, you lose weeks of revenue and patients before you even know there’s a problem.
MedBillingTech tracks credentialing and re-credentialing for solo providers, group practices, and telehealth networks across all 50 states. Flat fee of $150 per application, with primary source documentation, payer follow-up, and ongoing cycle tracking included. Sixteen-plus years of payer enrollment experience.
Get a Free Credentialing Assessment →
Or call (512) 254-3133 to talk through where your renewals stand.
