PECOS Provider Enrollment Verification (2026) — Quarterly Checklist

PECOS provider enrollment must be verified quarterly for every billing, ordering, and referring provider associated with the practice. Each provider must hold a current PECOS record under 42 CFR § 424.500-424.555, and most provider types revalidate every five years per § 424.515. Quarterly internal verification catches revalidation notices the MAC sent to a stale address before a deactivation stops Medicare payment.

Cadence: why quarterly, not annual

CMS sends revalidation notices through the Medicare Administrative Contractor (MAC) approximately 60-90 days before the revalidation due date. If the notice arrives at a stale address, gets routed to the wrong staff member, or is overlooked, the next signal is a PECOS deactivation — and the first operational symptom is claims denying.

A 90-day quarterly check window is short enough to catch a missed revalidation notice before deactivation but long enough to be practical for a small practice. Annual is too slow; deactivation can occur 8-10 months into a 12-month gap, generating substantial overpayments before detection.

In our analysis of 400+ d3rx client binders, the recurring failure is at change-of-address. A practice moves locations, updates the EHR and the website, files the CMS-855I change with the MAC, then forgets — and three years later the revalidation notice goes to the old address. Quarterly PECOS lookup catches this; nothing else does reliably.

The entities to name in a credible PECOS discussion: the Centers for Medicare & Medicaid Services (CMS), PECOS itself, the Medicare Provider Enrollment Manual (Pub. 100-08, Chapter 15), the Medicare Program Integrity Manual, 42 CFR Part 424 Subpart P, the NPPES NPI registry, and the MAC for the practice's geography.

Cadence summary

| Trigger | Action | Source of truth | |---|---|---| | Quarterly (first business day) | Run PECOS lookup for every billing and ordering/referring provider | pecos.cms.hhs.gov + NPPES | | 90 days before any provider's 5-year mark | Pre-revalidation review and confirm address of record | PECOS Manage Account | | New hire / new affiliation | CMS-855R reassignment + verify enrollment status | PECOS submission tracking | | Change of address | CMS-855I within 30 days under § 424.516 | PECOS submission tracking | | Change of ownership | CMS-855A/B/I as applicable, AO signature | PECOS submission tracking | | Sanction or board action | Immediate PECOS review + counsel | PECOS + state board notice |

The quarterly workflow

``` Step 1 — Build the verification roster (first business day of the quarter) Pull credentialing file. List every billing provider, every reassigned provider, every ordering/referring provider used in the last quarter. Include locums, supervising physicians, and PA/NP collaborating MDs.

Step 2 — Log into PECOS (https://pecos.cms.hhs.gov/) Use the practice's Authorized Official credentials. Confirm the AO and Delegated Official designations are current.

Step 3 — Run individual lookups per provider Verify: enrollment status (Approved/In Review/Deactivated), reassignment to current TIN, practice location address, revalidation due date, next 5-year mark.

Step 4 — Cross-check against the CMS Ordering & Referring file https://data.cms.gov/provider-characteristics/medicare-provider-supplier-enrollment/order-and-referring Confirm any ordering/referring providers used in claims appear in this file.

Step 5 — Cross-check NPI on NPPES https://npiregistry.cms.hhs.gov/ Confirm address and primary taxonomy align with PECOS.

Step 6 — File the dated evidence in the binder One per quarter, named YYYY-Q# PECOS verification log.

Step 7 — Escalate any deactivation or pending revalidation immediately. ```

For a practice with under 20 providers, the quarterly cycle takes a trained staff member roughly 60-90 minutes. Larger practices typically use a third-party enrollment service or aggregate via the MAC's portal.

The audit-ready quarterly log

| Date verified | Provider (last, first) | NPI | PECOS ID | Enrollment status | Practice location on file | Revalidation due | Reassigned to current TIN (Y/N) | Verifier | |---|---|---|---|---|---|---|---|---| | 2026-04-01 | Adams, Jane (MD) | 1234567890 | I20140101000001 | Approved | 123 Main St, City, ST | 2027-08-12 | Y | JS | | 2026-04-01 | Brown, Marcus (PA) | 1234567891 | I20180601000123 | Approved | 123 Main St, City, ST | 2028-03-22 | Y | JS | | 2026-04-01 | Chen, Lisa (NP) | 9876543210 | I20210301000456 | Pending revalidation | 123 Main St, City, ST | 2026-06-15 | Y | JS | | 2026-04-01 | Davis, Tom (MD — locum) | 5555555555 | I20150101000999 | Approved | (locum group address) | 2026-12-01 | Y (via 855R) | JS | | 2026-04-01 | Smith, Rachel (MD — referring only) | 4444444444 | I20120101000111 | Approved (in O&R file) | external practice | 2027-02-04 | n/a | JS |

Required columns

• Date of verification (exact date, not month).
• Provider name and NPI.
• PECOS Provider Transaction Access Number (PTAN) or PECOS ID where applicable.
• Enrollment status (Approved / In Review / Returned / Deactivated / Revoked).
• Practice location on file (matches the practice's billing address).
• Revalidation due date.
• Reassignment status if billing through a group.
• Verifier initials.

Retention: at least 10 years to align with False Claims Act statute of limitations and the Medicare Program Integrity Manual recordkeeping expectations.

Evidence to retain

For every quarterly cycle, file in the binder:

1. The roster of providers verified.
2. A PECOS lookup screenshot or export per provider.
3. The dated log table above.
4. For any pending revalidation: the CMS-855 submission confirmation, MAC correspondence, and target completion date.
5. For ordering/referring-only providers: the CMS Ordering & Referring file entry confirming eligibility.
6. The current AO and DO designation evidence.

Escalation path on a deactivation or revalidation flag

A "Deactivated," "Revoked," or "Pending revalidation past due" status is a stop-billing event for the affected provider. The workflow:

1. Same day: stop submitting claims with the affected provider as the rendering/billing provider. Document the stop with a dated note.
2. Same day: identify and notify the provider, the practice administrator, and outside counsel if revocation rather than deactivation.
3. Within 3 business days: file the CMS-855I or 855B reactivation/revalidation. PECOS submission generates a tracking number that goes into the binder.
4. Identify paid claims with dates of service after the effective date of deactivation. Document and refund within 60 days of identification per the 60-day Overpayment Rule.
5. MAC follow-up: most MACs process reactivation within 60-90 days. Track the application status weekly via PECOS.
6. Restart billing only after written reactivation confirmation from the MAC.
7. File the matter in the binder: deactivation date, root cause (missed notice, stale address, etc.), reactivation timeline, refunded amounts.

This is the workflow where quarterly verification pays off: catching a deactivation within 90 days versus 12 months is the difference between refunding a quarter of claims and refunding a year.

Ordering and referring providers — the second-line review

Under 42 CFR § 424.507, claims requiring an ordering or referring provider's NPI are denied if that NPI does not appear in the CMS Ordering & Referring file. The practice has limited control over external providers' enrollment status — but it has full control over verifying at intake.

What practices most often miss is the workflow at intake: capturing the ordering provider's NPI on the referral form, validating against the Ordering & Referring file before scheduling, and re-verifying for repeat referrers quarterly. Adding this check to the binder catches the slow drift where a long-time referring physician retires from Medicare and the claims start denying.

What goes wrong

The recurring defects in d3rx's review:

1. Stale address on file. PECOS shows the prior office; the revalidation notice was returned to sender.
2. Reassignment lapse. The provider's CMS-855R to the current TIN was never filed after a hire from another practice; claims pay then claw back.
3. Ordering/referring NPI never checked at intake. Denials show up after the claim, not before the encounter.
4. AO designation outdated. The Authorized Official is a former owner; no one in the practice can sign a CMS-855 today.
5. Locum coverage not enrolled. The locum is billing under the host practice's group but is not reassigned in PECOS; the host bears the overpayment risk.
6. DMEPOS revalidation missed. DMEPOS is on a 3-year cycle, not 5; orthopedic and primary-care practices billing DME often track the 5-year cycle by default and miss revalidation.

Maintenance cadence summary

• Quarterly: full provider verification + ordering/referring spot-check.
• At new hire: CMS-855R reassignment + verify PECOS within 30 days.
• At any address change: CMS-855I within 30 days (§ 424.516).
• At any sanction or board action: immediate review + counsel.
• Annually: confirm AO and DO designations, refresh the Authorized Official's PECOS credentials, confirm MAC notice routing email.
• 90 days before each 5-year mark: pre-revalidation review.

State preemption note: PECOS is purely federal. State Medicaid enrollment is parallel and separately tracked — most states have their own enrollment system and revalidation cadence (often 3-5 years). Practices billing Medicaid run state Medicaid revalidation alongside the PECOS workflow with the same quarterly cadence.

How d3rx fits

The d3rx compliance binder tracks the PECOS verification roster, files the dated quarterly evidence, flags upcoming revalidation dates, and ties ordering/referring provider verification into the intake workflow. It is an administrative documentation aid, not an enrollment service. The practice (or its credentialing vendor) remains responsible for filing CMS-855 submissions and for the underlying enrollment status.