PECOS 2.0 Migration Deadline: Legacy System Shuts Down Q4 2026

What Is the PECOS 2.0 Migration Deadline?

As of Q4 2026, CMS is decommissioning the legacy PECOS system and requiring every Medicare-enrolled provider to operate through PECOS 2.0, the rebuilt Provider Enrollment, Chain, and Ownership System. The migration rolled out in four phases beginning in late 2025, with Phase 3 (existing enrollment migration by MAC jurisdiction) completing during Q3 2026 and Phase 4 (legacy system shutdown) beginning now. Any provider who has not verified their enrollment data against the new system’s real-time validation checks risks a Stay of Enrollment payment freeze when PECOS 2.0 flags discrepancies that the old system would have ignored.

• What changed: Legacy PECOS accepted enrollment data without cross-referencing it against external databases in real time. PECOS 2.0 validates every data field against NPPES, IRS records, and adverse action databases at the point of entry, and it applies automatic holds when it finds a mismatch.
• Who is affected: Every physician, group practice, institutional provider, and supplier with an active Medicare enrollment. There is no opt-out. CMS notifies each provider before their enrollment migrates, but the migration is mandatory regardless of whether the provider takes action.
• What to do now: Audit your PECOS enrollment data, verify it matches your NPPES record and IRS information exactly, update any expired documents, and resolve every discrepancy before the automated system surfaces it and triggers a payment freeze.

Why CMS Rebuilt PECOS

The legacy PECOS system served as the official enrollment portal for over two decades, but it operated with significant limitations that CMS determined were no longer acceptable for program integrity. The old system accepted data entries without real-time validation, processed applications in isolation from other federal databases, and allowed discrepancies to persist across enrollment records for years without triggering a review.

PECOS 2.0 addresses those gaps by validating enrollment data in real time against NPPES (the National Plan and Provider Enumeration System), IRS records, and adverse action databases. The system flags mismatches immediately rather than discovering them months or years later during a revalidation cycle. CMS also introduced the Stay of Enrollment mechanism, which applies an automatic payment freeze when validation identifies a discrepancy serious enough to warrant review.

For practices, the practical effect is that data hygiene mistakes that sat dormant under the legacy system are now surfacing as enrollment holds and payment freezes. A practice address listed as “Suite 204” in PECOS but “Ste 204” in IRS records can trigger a Stay of Enrollment under the new system’s matching logic. That level of sensitivity is intentional: CMS designed PECOS 2.0 to catch the inconsistencies that fraud investigations have historically found buried in enrollment records.

What Does the PECOS 2.0 Migration Timeline Look Like?

Phase 3 is where most practices first encountered the new system’s validation logic, because the migration triggered an automated data consistency check on every existing enrollment record. Practices that had clean records saw a smooth transition. Practices with address mismatches, expired documents, unreported ownership changes, or NPI discrepancies received flags that required resolution before their enrollment record was fully activated in the new system.

Phase 4, which begins Q4 2026, is the point of no return. Legacy PECOS no longer accepts any transactions. Every revalidation, every change of information, every reassignment, and every new enrollment now goes through PECOS 2.0 exclusively. At Contracting Providers, the most common issue we are seeing right now is practices that assumed the migration was automatic and required no action on their part. The migration of the data is automatic. The resolution of the discrepancies that the migration surfaces is not. For practices that also need to update their CMS-855B enrollment, our guide on the revised CMS-855B mandatory changes covers the form revisions that took effect in August 2026.

What Is a Stay of Enrollment?

A Stay of Enrollment is the most operationally dangerous mechanism in PECOS 2.0 for practices that have not audited their data. It is an automatic payment freeze that the system applies when real-time validation identifies a discrepancy in a provider’s enrollment record that CMS determines warrants review before processing can continue.

Under the Stay of Enrollment, the provider’s enrollment goes under review, Medicare payments stop, and claims sit pending until someone resolves the underlying issue. The freeze is not a denial. The claims are held, not rejected. But the revenue interruption is immediate, and it continues until the discrepancy is cleared, which can take days or weeks depending on the nature of the mismatch and how quickly the provider or their credentialing team responds.

The issues that trigger a Stay of Enrollment under PECOS 2.0 include mismatches between the PECOS practice address and the NPPES registry address, expired state licenses or DEA registrations in the enrollment file, ownership or managing control information that has not been updated within the required 30-day reporting window, and data that conflicts with IRS records such as legal name or tax identification mismatches.

Providers often come to us after a Stay of Enrollment has already frozen their payments, and the resolution process always takes longer than the prevention would have. An enrollment data audit that takes a few hours to complete proactively costs weeks of revenue when the Stay of Enrollment hits first.

How to Prepare Before the Migration Catches You

These are the steps every Medicare-enrolled provider should complete before the end of 2026, and ideally before the next enrollment transaction triggers a validation check under PECOS 2.0.

Verify your PECOS enrollment data matches your NPPES record exactly. Compare every practice address, provider name, taxonomy code, and contact detail across both systems. PECOS 2.0 cross-references these in real time, and any discrepancy can trigger a hold.

Confirm your IRS information matches your enrollment record. Your legal business name, tax identification number, and registered address must align between your IRS records and your PECOS enrollment. Formatting differences that seemed harmless under legacy PECOS now surface as validation failures.

Update any expired documents in your enrollment file. State licenses, DEA registrations, malpractice certificates, and any other time-limited documents in your PECOS record must be current. PECOS 2.0 validates document expirations in real time rather than catching them at the next revalidation cycle.

Report any ownership or managing control changes that occurred in the last 12 months. PECOS 2.0 requires reporting within 30 days of any ownership or managing control change. Under the legacy system, the window was 90 days, and many practices reported at revalidation instead. Any unreported changes from the past year need to be filed before the next PECOS interaction.

Reconcile your reassignment records. If your group has added or removed practitioners without updating the reassignment in PECOS, those discrepancies will surface during a migration check or the next enrollment transaction. Ensure every active practitioner has a current reassignment on file.

Set a calendar for your next revalidation date. PECOS 2.0 sends automated alerts when revalidation is approaching, but practices should not rely solely on the system notification. CMS generally requires revalidation every 5 years for most providers and every 3 years for DMEPOS suppliers. For practices also navigating Medicaid revalidation alongside Medicare, our guide on the CMS Medicaid revalidation mandate covers the parallel requirement.

Common Mistakes Providers Are Making Right Now

These are the errors we are seeing most frequently as practices encounter PECOS 2.0 for the first time.

Assuming the migration is fully automatic. The data migration is automatic. The resolution of discrepancies is not. Every provider whose enrollment record contains a mismatch between PECOS, NPPES, and IRS must resolve it manually.

Ignoring the CMS migration notification. CMS sends a notification before each provider’s enrollment migrates. That notification is not informational. It is the signal to audit your data before the new system’s validation logic runs against it. Practices that delete the notification or route it to a general inbox miss the window.

Not updating the NPPES record alongside the PECOS record. Under legacy PECOS, you could update your enrollment address without touching NPPES and the mismatch would persist silently. Under PECOS 2.0, that mismatch triggers a Stay of Enrollment. Every change in PECOS must be mirrored in NPPES, and vice versa.

Still using old CMS-855 form versions. The revised CMS-855B became mandatory on August 3, 2026, and MACs reject old versions automatically. Practices that attempt to file a change of information or revalidation using the old form version waste 30 to 60 days on a preventable rejection. For the specific form changes, see our coverage of the mandatory CMS-855B revisions.

Not accounting for the CAQH to DataSpring rebrand in their credentialing workflow. The CAQH rebranding to DataSpring in mid-2026 changed the name of the provider data portal. Practices that reference the old “CAQH ProView” name in their internal workflows or payer communications should update to “CAQH Provider Data Portal.” For the full picture of what changed, see our guide on the CAQH DataSpring rebrand.

In our experience handling Medicare enrollment for practices across 40 states, the providers who audit their data proactively before a PECOS interaction resolve discrepancies in hours. The providers who wait for a Stay of Enrollment to surface the problem resolve the same discrepancies over weeks, with their payments frozen the entire time.

Frequently Asked Questions

Next Steps

Need to update your CMS-855B for the new mandatory form version? Our guide on the revised CMS-855B changes covers every section that was added or modified.

Navigating Medicaid revalidation alongside your Medicare enrollment? See our coverage of the CMS Medicaid revalidation mandate for the parallel requirement that affects dual-enrolled providers.

Updating your credentialing workflows after the CAQH rebrand? Our guide on the CAQH DataSpring rebrand explains what changed in the provider data portal.

Not sure whether your enrollment data is clean enough to survive the PECOS 2.0 validation checks? Book a free consultation and our team will tell you exactly where the risks are.