Recredentialing happens every 36 months. Medicare revalidation happens every 60 months. CAQH reattestation happens every 120 days. Primary source verification must be completed within 180 days of the credentialing committee decision. These are four independent clocks running on four different timelines, and most practices and billing companies treat them as if they are the same process. They are not. Missing any one of them creates a different category of problems with different consequences.
If you run a billing company, this confusion is costing you money right now. A provider who completed re-credentialing this quarter can still face a Medicare revalidation due next month and a CAQH attestation due next week. Finishing one does not reset the others. They operate independent cycles, with independent requirements, and independent penalties for noncompliance.
After 18 years consulting in the RCM industry, the number one credential error I see in billing companies with 1 to 50 employees is conflating these timelines. A credentialing coordinator finishes are credentialing cycle and assumes everything is current. Meanwhile, the CAQH attestation lapsed 40 days ago and Medicare sent a revalidation request that is sitting in a mailbox.
Recredentialing: The 36-Month Payer Cycle
Recredentialing is the process of re verifying a provider’s credentials with each payer they participate in. Most payers require it every 36 months, matching NCQA (National Committee for Quality Assurance) standards.
During recredentialing, the payer re verifies the provider’s medical education, residency training, board certification, state licensure, DEA registration, malpractice coverage, malpractice claims history, work history, and hospital privileges. The provider submits updated information. The payer’s credentialing committee reviews it. The provider’s network status continues or terminates based on the outcome.
Miss the recredentialing deadline and the provider’s network status lapses. Claims go out under a provider who is no longer credentialed with the payer. Denials follow. And because recredentialing takes 60 to 120 days to process in most cases, a late start means a participation gap that creates months of claim exposure.
For billing companies managing multiple providers across multiple payers, the recredentialing load compounds. Every provider carries a separate 36-month cycle with every player. A billing company managing 30 providers across 8 payers is tracking up to 240 independent recredentialing timelines.
Medicare Revalidation: The 60-Month Federal Cycle
Medicare revalidation is a separate process from payer recredentialing. CMS requires providers to revalidate their Medicare enrollment every 60 months through PECOS (the Provider Enrollment, Chain, and Ownership System) or by submitting an updated CMS 855 form.
Revalidation confirms that the provider’s enrollment information is current and accurate. It covers practice location, specialty designation, ownership structure, managing employees, and adverse action history. It is not a clinical credential review. It is an enrollment verification.
When CMS sends a revalidation request, the provider has a limited window to respond. Failure to respond leads to deactivation of the provider’s Medicare enrollment. Once deactivated, no Medicare claims can be billed under that provider until enrollment is reactivated, a process that can take weeks or months.
The 60-month cycle does not match the 36-month payer recredentialing cycle. A provider who completed payer recredentialing last year can still face Medicare deactivation if revalidation is overdue. The two processes verify different information through different systems on different timelines.
CAQH Reattestation: The 120-Day Rolling Cycle
CAQH requires providers to re-attest their profile data every 120 days. This is the shortest and most frequent of the three cycles. It is also the most missed.
Re attestation confirms that the data in the provider’s CAQH profile is current. It does not involve a credentialing committee review. It does not re-verify primary sources. It is a data currency confirmation. But when it lapses, the profile goes inactive, and payers that rely on CAQH for credentialing data cannot verify the provider’s status.
The 120-day cycle creates roughly three attestation deadlines per year per provider. For a billing company managing 30 providers, that is approximately 90 CAQH re-attestation events per year, each on its own rolling timeline, each with different due dates.
Primary Source Verification: The 180-Day Window
Primary source verification (PSV) is the process of verifying credentials directly with the issuing body rather than accepting copies from the provider. Medical school verification from the school. Board certification from the certifying board. License verification from the state medical board.
NCQA standards require that PSV be completed within 180 days of the credentialing committee’s decision. If PSV was completed 200 days before the committee met, it must be redone. This 180-day window does not match any of the other three cycles. It is triggered by the committee decision date, not by a calendar anniversary.
For billing companies managing credentialing, this means PSV timing must be coordinated with the committee schedule. Complete PSV too early and it expires before the committee meets. Complete it too late and the committee cannot make a decision.
How These Clocks Interact
Here is where billing companies get tripped up. A provider’s credential status can appear current when one or more of these clocks has expired.
A provider who completed payer recredentialing three months ago (36-month clock reset) can still face an inactive CAQH profile (120-day clock lapsed). The recredentialing is current. The CAQH is not. Claims may still be affected.
A provider who has an active CAQH profile and current payer credentialing can still face Medicare deactivation if the 60-month revalidation request went unanswered.
A provider who passed recredentialing with PSV completed 190 days before the committee decision has a PSV that does not meet the 180-day NCQA standard, while the credentialing itself was approved.
Each scenario creates a different problem. Each requires a different fix. And none of them is visible if your credentialing system treats all four cycles as a single process.
Managing This at HARRIS CareTracker
At HARRIS CareTracker, we track each of these cycles independently with separate timelines, separate alert ladders, and separate status indicators. The credentialing dashboard shows each provider’s status across all four clocks from a single screen. Recredentialing due dates, revalidation deadlines, CAQH attestation cycles, and PSV windows are all visible, independent, and alerting.
When a billing coordinator looks at a provider, they do not see a single “credentialing status.” They see four distinct statuses, because that is what credentialing actually is. Four clocks. Four timelines. Four consequences. One dashboard.
Which of your providers is current on recredentialing but overdue on CAQH or Medicare revalidation right now?
Follow for more on revenue cycle management, claim denial management, medical billing workflow, and credentialing operations, and building billing companies that track every clock.
Frequently Asked Questions
What is the difference between recredentialing and Medicare revalidation?
How frequently does CAQH reattestation occur?
What happens if a provider misses a Medicare revalidation deadline?
What is the 180-day PSV window?
How does HARRIS CareTracker track these four independent credentialing clocks?
About the Author
Thomas Koehl is a 30 year health technology veteran and currently Director of Marketing at Harris CareTracker. Prior leadership roles at QRS Healthcare Solutions focused on supporting revenue cycle management partners. Following Hurricane Katrina, he served as Director of a large New Orleans medical clinic that delivered care to over 32,000 patients. Koehl has testified before the U.S. House Committee on Energy and Commerce as an expert witness on disaster healthcare delivery. He also volunteers as COO of International Medical Alliance, a nonprofit providing free medical care to impoverished communities in developing countries. He writes about the business, strategy, and human side of health technology for the practitioners and leaders living it day to day.
Follow me here for more breakdowns, and follow HARRIS CareTracker for product updates and resources.
