What Is the CMS Medicaid Revalidation Mandate?
As of August 2026, CMS has directed every state Medicaid agency to revalidate all enrolled providers within a 24-month window under 42 CFR 455.414. Revalidation is the process of confirming that a provider’s enrollment information, credentials, licensure, and practice details remain accurate and compliant with federal and state requirements. Providers who do not complete revalidation by their state’s deadline face revocation of their Medicaid billing privileges, meaning they lose the ability to treat and bill Medicaid patients.
- Nationwide scope: This mandate applies to every Medicaid-enrolled provider in every state, not just specific regions or provider types.
- Risk-tiered rollout: States are issuing revalidation notices in phases based on risk category, starting with high-risk providers such as DME suppliers and home health agencies.
- Digital portals replacing paper: Multiple states have launched new online enrollment portals and discontinued paper-based revalidation, changing the submission process providers have used for years.
The CMS Directive Behind the Mandate
In April 2026, CMS issued a directive requiring all state Medicaid agencies to implement comprehensive provider revalidation strategies under 42 CFR 455.414. The requirement is not new in concept. Federal regulations have long required states to revalidate Medicaid providers at least every five years. What changed is the enforcement posture. CMS is now requiring states to demonstrate active revalidation progress across their entire provider base within 24 months, with documented timelines, phased rollout plans, and risk-based prioritization.
The directive comes against the backdrop of CMS’s broader program integrity push. The CY 2027 Home Health PPS proposed rule, published July 6, 2026, includes sweeping expansions to Medicare enrollment revocation authority. On the Medicaid side, CMS is applying the same pressure through revalidation mandates aimed at identifying providers with outdated credentials, lapsed licensure, missing NPI numbers, or unresolved exclusions. According to the NYS Department of Health press release dated August 4, 2026, New York received CMS approval to implement its phased revalidation plan and became one of the first major states to formally announce its rollout.
For providers, the practical question is simple: when is my state sending my revalidation notice? The answer depends on where you are enrolled, your Medicaid enrollment status, and which risk tier your provider type falls into.
Who Does the Medicaid Revalidation Mandate Apply To?
The CMS Medicaid revalidation mandate applies to every provider currently enrolled in a state Medicaid program, regardless of provider type, specialty, or volume of Medicaid patients. This includes physicians, non-physician practitioners, group practices, clinics, behavioral health providers, DME suppliers, home health agencies, rehabilitation facilities, and any other entity with an active Medicaid provider ID.
States are prioritizing revalidation notices using a risk-tiered system established under 42 CFR 455.450. Providers are assigned to one of three screening categories based on their provider type and history:
| Risk Tier | Provider Types | Screening Requirements |
|---|---|---|
| High | DME suppliers, home health agencies, providers not revalidated since COVID PHE | Full revalidation + pre/post-enrollment site visit + fingerprint background check for owners with 5%+ interest |
| Moderate | Ambulance services, community mental health centers, comprehensive outpatient rehab | Full revalidation + unscheduled or unannounced site visit possible |
| Limited | Most physicians, group practices, hospitals, clinics | Full revalidation with standard document verification |
In our work handling Medicaid enrollment across 40+ states, the most common misconception we encounter is that providers assume revalidation only affects those who have not been billing actively. That is incorrect. Active billing status does not exempt a provider from revalidation. Every enrolled provider must complete the process or face revocation, regardless of claim volume.
Why CMS Accelerated the Timeline
Three factors converged to push CMS toward this mandate. First, the COVID-19 public health emergency suspended routine revalidation cycles for over two years. During that period, provider enrollment data grew stale. Licenses expired, addresses changed, ownership structures shifted, and exclusion statuses went unchecked. CMS estimates that a significant percentage of currently enrolled Medicaid providers have not completed a full revalidation since before 2020.
Second, CMS has been steadily expanding its program integrity enforcement. The July 6, 2026 proposed rule that affects Medicare enrollment revocation authority signals the same enforcement philosophy on the Medicaid side: outdated enrollment records are treated as compliance failures, not administrative oversights. Third, state Medicaid spending reached $931.7 billion in 2024 according to CMS national health expenditure data, and Congressional scrutiny of Medicaid waste, fraud, and abuse has intensified. Revalidation is the mechanism CMS uses to verify that every dollar flows to providers who are currently qualified, properly licensed, and compliant with federal screening standards.
The bottom line for providers is that this is not a routine cycle. States are compressing what was previously a rolling five-year process into a two-year sprint with hard deadlines and real consequences for non-compliance.
What Happens If You Miss Your Medicaid Revalidation Deadline?
If a provider does not complete revalidation by their state-assigned deadline, their Medicaid enrollment is subject to revocation under 42 CFR 455.416. Revocation means the provider loses the ability to bill Medicaid for any services rendered after the revocation effective date. Claims submitted after revocation are denied, and depending on the state, providers may be required to refund payments received during any period of non-compliance.
The financial exposure is substantial. For a solo practitioner with even a moderate Medicaid patient panel, losing billing privileges for 60 to 90 days while a new enrollment application processes can mean $30,000 to $80,000 in lost revenue. For group practices or behavioral health organizations with higher Medicaid volumes, the figure can exceed six figures per quarter.
Reinstatement after revocation is not automatic. Providers must submit a new enrollment application and go through the full screening process again, including primary source verification, background checks for high-risk categories, and site visits where applicable. In states like Texas, where Medicaid enrollment backlogs have been among the longest in the country, re-enrollment after revocation can take four to six months. We see practices come to us after revocation expecting a quick fix. There is no quick fix once enrollment is terminated. The only reliable protection is completing revalidation before the deadline.
If your practice is enrolled in Medicaid and you have not received or responded to a revalidation notice, do not wait for the deadline to find you. Our team can verify your current revalidation status across every state where you are enrolled and handle the submission process from document collection through portal submission.
How to Prepare for Medicaid Revalidation
Completing Medicaid revalidation requires assembling current documentation, verifying data accuracy across multiple systems, and submitting through your state’s designated portal before your assigned deadline. These are the steps providers should take now, before a revalidation notice arrives.
- Confirm your NPI is active and matches your enrollment record. Under the new requirements, all Medicaid-enrolled providers must hold a valid National Provider Identifier. Providers currently enrolled without an NPI must obtain one before their revalidation due date.
- Update your CAQH profile. While CAQH (now operating under the DataSpring name) is primarily used for commercial payer credentialing, several states reference CAQH data during Medicaid revalidation. Confirm your attestation is current and all documents are unexpired.
- Verify your state license, DEA registration, and board certifications are current. Expired credentials during revalidation review trigger an automatic hold or return of your application.
- Run an OIG and SAM.gov exclusion check on yourself and every owner, managing employee, and billing staff member. Exclusion matches result in immediate denial of revalidation and potential civil monetary penalties.
- Confirm your practice address, contact information, and ownership disclosure match what is on file with your state Medicaid agency and in PECOS if you are dually enrolled in Medicare.
- Identify which portal your state uses for revalidation. New York now requires the Provider Services Portal (PSP). Maryland is transitioning to MPRIME in October 2026. Illinois uses IMPACT. Florida uses FLMMIS. Each state has its own system, and submitting through the wrong channel can result in a returned application.
- Document your response timeline. Once you receive a revalidation notice, most states give 30 to 60 days to respond. Mark the deadline immediately and begin document assembly the same day.
Common Mistakes That Delay Revalidation
The most frequent revalidation failure we see is not a missed deadline. It is an incomplete submission that gets returned, which restarts the clock from the resubmission date. In a compressed revalidation cycle, a returned application can push a provider past their deadline without any deliberate delay on their part.
Choosing the wrong enrollment type is the single most common mistake providers make when they attempt Medicaid enrollment or revalidation on their own. For revalidation specifically, the error often looks like submitting a change of information form when the state expects a full revalidation application, or vice versa. These are treated as different transactions by the state agency.
Other frequent errors include submitting expired supporting documents, failing to disclose ownership changes that occurred since the last enrollment cycle, using a legacy paper process in states that have moved to digital-only portals, and not completing the electronic signature correctly. In New York, the DOH identified the top reasons applications are returned: incorrect signature, incomplete ownership section, EFT upload errors, and missing DEA certificates. These are the same patterns we see across other states as they modernize their portals.
Multi-state practices face a compounded version of this problem. A provider enrolled in Medicaid in three states must complete three separate revalidation processes, through three different portals, on three different timelines. Missing one while completing the others is how revenue gaps open.
In-House vs. Outsourced Revalidation
Practices that have handled revalidation internally in previous cycles may find this round significantly more complex. The shift to digital portals, tighter documentation standards, and compressed timelines have raised the administrative burden. According to Medallion’s 2026 State of Payer Enrollment and Medical Credentialing survey, one in five hospitals reports losing more than $1 million annually due to credentialing and enrollment delays. The same dynamic applies to Medicaid revalidation at the practice level.
The decision between in-house and outsourced revalidation comes down to capacity and state-specific knowledge. An office manager who revalidated in Florida two years ago is working with a different portal workflow today. A practice expanding into New York for the first time must navigate the PSP system, risk-tier screening requirements, and NPI mandates that did not exist during the last revalidation cycle.
Providers often come to us after they hit a roadblock or receive a denial. The most cost-effective approach is to engage before the notice arrives, so the documentation is assembled and the submission is ready to file the day the revalidation window opens. Our Medicaid enrollment service covers revalidation as part of our maintenance plans, and we support one-off revalidations with the correct access from the client.
Frequently Asked Questions
What is Medicaid provider revalidation?
Medicaid provider revalidation is the process of verifying that an enrolled provider’s credentials, licensure, practice information, and ownership disclosures remain current and compliant with federal and state requirements. It is required under 42 CFR 455.414 and must be completed at intervals set by each state, typically every three to five years.
How often do providers need to revalidate their Medicaid enrollment?
Federal law requires revalidation at least every five years, but the current CMS mandate compresses the timeline. All states must revalidate their entire enrolled provider base within 24 months of the April 2026 directive, meaning many providers will be revalidated on a shorter cycle than usual.
Is Medicaid revalidation the same as Medicare revalidation?
No. Medicaid revalidation is administered by each state Medicaid agency through its own portal and process. Medicare revalidation runs through PECOS and the Medicare Administrative Contractors. A provider enrolled in both programs must complete revalidation separately for each, though some states allow Medicare screening results to satisfy certain Medicaid requirements.
What documents are needed for Medicaid revalidation?
Required documents typically include current state medical license, DEA registration, board certification, malpractice insurance certificate, W-9, NPI confirmation, ownership and control disclosure, and a signed provider agreement. Exact requirements vary by state and risk tier.
Can I revalidate by paper or do I have to use a digital portal?
An increasing number of states now require digital-only revalidation through their designated online portal. New York discontinued paper-based revalidation as of May 2026. Maryland is transitioning to MPRIME in October 2026. Providers should verify their state’s current submission requirements before beginning the process.
What happens to my patients if my Medicaid enrollment is revoked?
If your enrollment is revoked, you can no longer bill Medicaid for services. Patients may need to be referred to another in-network provider, and any services rendered after the revocation date will not be reimbursed. Reinstatement requires a new enrollment application, which can take 60 to 180 days depending on the state.
Does active billing protect me from revalidation requirements?
No. Active billing status does not exempt any provider from revalidation. Every enrolled provider must complete the process regardless of claim volume, patient panel size, or years of continuous enrollment.
Next Steps
If you are enrolled in Medicaid in any state, verify your revalidation status now. Check that your NPI, licensure, and ownership information are current. For a walkthrough of the Medicaid enrollment and revalidation process, see our guide to getting credentialed with Medicaid. If you are enrolled in multiple states and need help managing revalidation across different portals and timelines, our team handles this daily across 40+ states.
Do not wait for a revocation notice to act. Our enrollment specialists can confirm your revalidation status, assemble your documentation, and submit through the correct state portal on your behalf. Reach out today to protect your Medicaid billing privileges.
