Medicaid revalidation every five years: the federal rule and the state notices to watch

What does 42 CFR 455.414 require of a state Medicaid agency?

It requires the state to revalidate every enrolled provider at least every five years. The regulation reads, in full: the State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years¹. That’s the whole section: no notice method, no grace period, no document list.

So the federal rule is a floor. A state can run a shorter cycle, and no provider type is carved out¹. Everything else, from how you hear about it to what you upload, is the state’s design.

How does Medicaid revalidation differ from Medicare’s?

Different agency, different due date, different notice, and a different penalty. Medicare’s cycle is set by CMS: providers and suppliers revalidate every five years and DMEPOS suppliers every three; CMS posts due dates seven months in advance, and the enrollment contractor sends a notice by email or mail about three to four months before². Medicaid has no national machinery like that. The state decides, and Ohio’s FAQ makes the point groups miss: revalidating with Medicare doesn’t count toward Ohio Medicaid³.

The penalties differ in wording, not in cash. Medicare can hold reimbursement or deactivate billing privileges, and it won’t pay for services during the deactivated period². Ohio terminates the provider, and reactivation takes effect only when completed, with no retroactive enrollment³. The Medicare side is in Medicare revalidation: finding your due date and what deactivation costs.

How do states send revalidation notices, and where do they go wrong?

To the contact data on your state enrollment record, which is exactly where they go wrong. Ohio sends the notice about 120 days before the deadline, mails it to the Correspondence Address on record, emails the address on record with ODM, and posts it in the PNM module’s correspondence folder under Enrollment Notices³. New York emails from its enrollment contractor and takes every revalidation through the Provider Services Portal⁴. The Ohio and New York pages list each portal.

Three channels sounds safe. But all three point at data the provider typed years ago: a closed office’s mailing address, a departed administrator’s email, a portal folder nobody opens. Ohio’s FAQ says it plainly: keep your Correspondence Address and email correct, and expect a separate notice for each provider number³.

So treat those contact fields as billing infrastructure: a shared mailbox the practice controls, a scheduled check of the portal folder, and a rule that any data change is made everywhere, because the systems don’t talk to each other. CAQH rebranded as DataSpring on June 7, 2026⁶, but its Provider Data Portal doesn’t push your new address to a state Medicaid agency; see CAQH is now DataSpring.

What happens to MCO claims when the state enrollment lapses?

Where the plan requires an active state Medicaid enrollment, they stop too, usually without a separate warning. The plan credentials you under its own contract, but its claim system checks the state enrollment when it adjudicates. Terminate the state record and the plan sees an ineligible provider on every claim from that date.

That’s what surprises groups: the plan contract looks fine and nobody called. Confirm each plan’s rule in writing; the state-to-plan handoff is covered in Medicaid managed care enrollment, plan by plan.

What documents does a Medicaid revalidation usually need?

A review of everything on file, with updates, plus whatever the state’s screening rules add. Ohio describes it as verifying or updating current provider information, including licenses and credentials, with additional disclosure information for some providers and a new provider agreement signed electronically at submission; ODM verifies the submission and sometimes conducts an on-site visit³.

Then the fee. Ohio collects a non-refundable application fee at revalidation from organizational providers only, $750 per application for 2026, waived if the organization paid Medicare or another state’s Medicaid within the past two years and submits proof³. And don’t take any steps to revalidate until you receive the notice³; Medicare returns unsolicited revalidations too².

Enforcement is tightening as well. CMS can already deny or revoke Medicare enrollment when a provider is suspended or revoked from Medicaid, and the July 1, 2026 home health proposed rule would extend that ground to owners and managing employees and make revocations retroactive⁵. Whether a missed Medicaid revalidation would trigger it is a question for your enrollment contractor.

How do you track revalidation for a group that bills in more than one state?

One tracker, one row per provider number per state, and a monthly check of each state portal’s correspondence folder. The federal rule gives the outer bound of five years¹; the state gives the actual date and channel. Your job is to make sure the date lands on a calendar someone reads.

Columns: state; provider number; last revalidation date; expected next date; notice channel and mailbox; portal login owner; status; and the claims-hold decision if the date passes. A payer enrollment service with a dedicated specialist keeps this live rather than in a spreadsheet opened once a year.

Then connect it to billing: whoever runs your Medicaid billing needs a weekly line listing provider numbers inside 120 days of a known or estimated date. The revalidation glossary entry is the short version for new staff; the credentialing and enrollment guide covers the maintenance cycle.

What to do this week

• List every Medicaid provider number you hold, by state, with its last revalidation date¹.
• Open each state portal’s correspondence folder; Ohio posts revalidation notices there under Enrollment Notices³.
• Replace any personal email on a state enrollment record with a mailbox the practice controls³.
• Ask each managed care plan, in writing, what happens to its claims if the state enrollment lapses.
• Add a “within 120 days of a revalidation date” line to the weekly billing report.