ERA and EFT Enrollment: How to Set Up Payments Payer by Payer

Published November 12, 2026

Illustration of an EFT deposit and an 835 remittance matched by the same TRN trace number and amount

Four business days. That is the point at which the HIPAA operating rules call an EFT without its matching 835, or an 835 without its deposit, late or missing. If your posting team has ever stared at a deposit it can't match to a remit, that clock is the reason the payer is supposed to have a written process for fixing it.

ERA and EFT enrollment is how you get there. You enroll separately with each health plan you bill to receive payments by ACH direct deposit (EFT) and remittance data as an X12 835 file (ERA). Health plans must use the HIPAA standards when you ask, so your job is mostly to ask correctly, confirm the setup, and keep it current when your bank, TIN or contractor changes.

TL;DR

  • Enrollment is per payer. CMS says a provider must enroll for EFT and ERA with each health plan it bills, and network status doesn't change a plan's duty to honor the request.
  • Plans must use the standards on request. Under 45 CFR 162.925(a)(1), a plan must pay by standard ACH EFT and send a standard 835 when a provider asks.
  • Virtual card fees are not banned outright. CMS's 2022 guidance, still the posted CMS position, says HHS doesn't regulate VCC fees, but you can insist on standard EFT instead.
  • Medicare uses two separate setups. EFT goes through PECOS or the CMS-588 to each MAC; the 835 is registered through that MAC's EDI enrollment.
  • CAQH EnrollHub is gone. CAQH says it has not been available since February 1, 2022.

What ERA and EFT are, and how the TRN ties them together

An EFT is the electronic instruction a health plan uses to have its bank move funds into your account. An ERA is the electronic explanation of that payment: which claims it covers, what was paid, and how charges were adjusted. For a field-by-field walk-through of the remit itself, see our guide to reading a remittance advice.

HIPAA adopted specific standards for both halves. Under 45 CFR 162.1602(d), the payment initiation uses the NACHA CCD+ format, and its addenda record carries the X12 835 "TRN Reassociation Trace Number." The remittance itself uses the X12 835 version 5010.

CMS notes that plans generally send the EFT and the ERA separately, so providers often receive them at different times. The TRN is the shared key: the same trace number should appear in the payment and in its 835, which is how you "reassociate" a deposit with its remit before posting.

Why you enroll separately with every payer

In its 2022 FAQ on virtual credit cards, CMS states that "in order to receive EFT payments through the ACH Network and receive ERAs, a provider must enroll to conduct EFT and ERA transactions with each health plan that the provider bills." So a new group, location or RCM client means a fresh round of enrollments.

The operating rules do standardize what a plan can ask for. The Phase III CORE 380 EFT Enrollment Data Rule, adopted at 45 CFR 162.1603, says a health plan or its agent "is required to collect no more data elements than the maximum data elements" in the rule's data set. The companion 382 rule does the same for ERA enrollment. Plans must also provide written instructions, a contact for questions and instructions for checking enrollment status.

Plans and their agents must offer an electronic way to enroll, though they may keep paper forms too. CMS says you will need your practice's TIN and your clinicians' NPIs to start, and EFT enrollment also collects your bank details. ERA enrollment also names the receiver of your 835s, usually a clearinghouse, which our clearinghouse explainer covers in more detail.

What HIPAA requires health plans to do

Under 45 CFR 162.925(a), "if an entity requests a health plan to conduct a transaction as a standard transaction, the health plan must do so." The same section says a plan may not delay or reject a transaction, or try to adversely affect the other party, because the transaction is a standard one.

CMS applied that to EFT and ERA in Guidance Letter 2022-04. When a provider asks, a plan must use all three standards: the CCD+ for payment, the TRN in its addenda, and the 835 for the remit. CMS adds that this holds "regardless of whether a provider is in the plan's network or otherwise affiliated with the plan."

A few related points from the same guidance and FAQ are useful when a payer pushes back:

  • Portal-only remits. If a plan posts remits to a web portal, it must still send a standard 835 to you or your clearinghouse when you request it.
  • Paper checks. HIPAA doesn't require a plan to honor a request for paper checks; ACH EFT is the only method a plan must provide on request.
  • Payment vendors. A plan may route enrollment and payment through its business associate, but CMS says the plan may be held accountable if that vendor doesn't comply with the standards.

There is one caveat on timing. CMS notes that if a provider doesn't request the standards, or requests them but doesn't complete the plan's enrollment process, the plan "may pay the provider via alternate methods and may send manual explanations of benefits and remittance advice." A half-finished enrollment leaves the plan free to pay another way.

Virtual credit cards and fees: where CMS stands

Some plans pay by single-use virtual credit card, and card networks typically charge the provider a percentage of each payment. CMS addressed this in Guidance Letter 2022-04 (March 22, 2022) and a follow-up FAQ (July 14, 2022). Both are still listed on CMS's Administrative Simplification guidance pages, which CMS last modified on March 16, 2026, and we found no newer CMS statement on VCC fees.

The HIPAA standards permit plans to pay by VCC, and CMS says HHS "does not regulate common business practices associated with VCC payments, including fees assessed by health plans or credit card networks." The FAQ also says the guidance does not decide whether charging fees for standard transactions is, by itself, a HIPAA violation.

What you can rely on is the right to switch. If you ask a plan that pays by VCC to pay through the ACH Network using the adopted standards instead, CMS says 162.925(a)(1) "requires the health plan to comply with the request." And if a plan makes standard EFT and ERA depend on accepting unwanted payment or reassociation services, which may include paying for them, CMS says that "may be construed as adversely affecting the transaction or the provider."

If a plan won't comply after a documented request, CMS points providers to its Administrative Simplification Enforcement and Testing Tool (ASETT) to file a complaint. Keep the request, its date and the plan's response, and check your contract's payment terms too.

Medicare: CMS-588 for EFT, MAC EDI enrollment for the 835

Medicare splits the two setups. EFT goes through Medicare provider enrollment, using PECOS or the paper CMS-588 EFT Authorization Agreement. Noridian, one of the Medicare Administrative Contractors (MACs), states that "CMS requires EFT at the time of enrollment, revalidation, a change of MAC, or an enrollment change request."

The CMS-588 instructions have several details that trip up new enrollments:

  • The bank account must be in the provider's legal business name or the individual practitioner's name, as reported to the IRS.
  • A provider may have only one EFT account per enrollment.
  • An EFT authorization must go to each Medicare contractor you submit claims to.
  • Every request goes through a pre-certification period in which the bank verifies the account before any deposits are made.

The form also says EFT enrollment "does not constitute enrollment as a provider or supplier in the Medicare program." Watch the form version: the November 2023 revision shows OMB approval expiring in November 2026, and Noridian advises downloading a new copy before each submission.

The 835 is a separate registration with the MAC's EDI department. On Noridian's EDI enrollment page, you register the billing NPI and TIN, choose a connectivity method (direct, the MAC portal, or a clearinghouse or billing service), and select the 835 among the transactions. Each MAC runs its own EDI process, so confirm the steps with yours.

CAQH EnrollHub: what happened to it

CAQH's 2020 product page described EnrollHub as letting providers enroll in electronic payments with multiple payers through one web form. The EnrollHub page now says plainly: "As of 2/1/2022, EnrollHub is no longer available." The caqh.org address now redirects to a site branded "DataSpring, powered by CAQH."

So there is no single CAQH portal to file new EFT enrollments through today. Enrollment runs through each payer's own process, or through the vendor the payer designates, and the CORE 380 and 382 rules still govern what data those processes may collect.

Reassociation: making each deposit match its 835

The Phase III CORE 370 EFT & ERA Reassociation rule puts duties on both sides. The plan must tell you during enrollment that you need to contact your bank to arrange delivery of three CCD+ fields: the effective entry date, the amount and the payment-related information that holds the TRN. You must then make that arrangement.

Skipping this step can break auto-posting, because HIPAA does not require your bank to pass those fields along in its deposit notification. CMS's guidance letter says providers are responsible for making sure their bank includes the needed data in a format and timeframe that supports reassociation.

The rule also sets timing. Outside retail pharmacy, the plan must release the 835 no sooner than three business days before the EFT's effective entry date and no later than three business days after it. Plans must meet that window 90% of the time within a calendar month, and the rule lets each plan define its own business days.

When something goes missing, the plan must have written Late/Missing EFT and ERA Transactions Resolution Procedures and must deliver them during enrollment. The rule defines late or missing as a maximum elapsed time of four business days following receipt of either the EFT or the 835. Save those procedures with the enrollment record.

What to track for every payer enrollment

Enrollment is not finished when the form goes out. Keep a short record per payer and per TIN.

What to recordWhy it matters
Submission date, method and confirmationProves you requested standard EFT and ERA if a plan later pays another way
Approval and effective datePayments before that date may still arrive by check or card
TIN, NPIs and payee name enrolledNoridian warns incorrect or incomplete banking information may delay EFT enrollment
835 receiver (clearinghouse or vendor ID)ERAs go wherever the enrollment points
First live 835 and matching depositConfirms the TRN is flowing end to end
Paper remit overlapPlans that issue paper remits must keep offering them for at least 31 calendar days of initial 835 testing, longer if needed to cover three payments
Late/missing procedure and contactNeeded after four business days without a match
Re-enrollment triggersBank, TIN, ownership or contractor changes need updated enrollment

The paper overlap comes from the Phase III CORE 350 rule, which also lets you stop paper remits early. Keep them until the 835 totals match your deposits.

Working "paid but no remit" and "remit but no payment"

A deposit with no 835 often comes down to one of three things. The 835 was sent but routed to an old receiver, the plan has not released it yet, or your bank is dropping the TRN so your system can't match the two. Check the bank detail for the addenda, then the clearinghouse, then the payer's late/missing procedure after four business days.

An 835 with no deposit points the other way. Confirm the effective entry date in the 835, check whether the bank account on file is current, and ask the payer for the trace number and payment date. If the 835's payment method shows a check rather than ACH, the plan may not have your EFT enrollment active for that TIN. If the payer says no payment was issued at all, the claim may still be on hold, and our guide to pended claims covers how to find out why.

Where automation fits after enrollment is live

Once enrollment is live, the recurring work is confirming what paid, when and under which payment number. SuperDial's claim status workflow checks status through EDI, payer portals and payer calls, and returns the paid amount and date, the check or EFT number, the denial reason and code, and the next action as structured fields. That check or EFT number is the reference a posting team needs when a deposit and a remit won't match.

FAQ

How long does EFT enrollment take?

It depends on the payer. For Medicare, First Coast, one of the MACs, says complete and accurate applications are usually processed within 45 to 60 days, with a confirmation letter at the end. Commercial payers set their own timelines, so record the expected date and follow up.

Do I have to re-enroll in EFT if I change banks?

Yes, you need to update the enrollment with each payer before the old account closes. For Medicare, the CMS-588 has a "Change to Current EFT Enrollment" option for account or bank changes, and Noridian lists a bank change as a reason to submit EFT information. Keep the old account open until deposits land in the new one.

Can my clearinghouse enroll for ERAs on my behalf?

Your clearinghouse can receive 835s for you, and CMS says a plan must send the standard 835 to you or a business associate acting for you, which may include a clearinghouse. For Medicare, Noridian lists a clearinghouse or billing service as one connectivity option, so check each payer's instructions on who must sign.

Is EFT enrollment the same as payer credentialing?

No. Credentialing and payer enrollment establish that you can bill the plan, while EFT and ERA enrollment only set up how you get paid and receive remits. The CMS-588 states that EFT enrollment does not make you an enrolled Medicare provider or supplier, so complete provider enrollment first.

Sources

Run a pilot on a real workflow.

Bring a representative batch, define the output schema, and validate ROI with your payer mix in 30 to 90 days.

Book a Demo
Superdial white logo
The communication layer for revenue cycle teams.
Workflows
Benefits Verification
Prior Authorization
Claim Status
Credentialing & Enrollment
Provider Data Management
Who We Serve
RCM Companies
Provider Groups
Orthopedics
Gastroenterology
Dental & DSOs
Health Systems
Payers
Digital Health
Pharma
Company
About Us
Case Studies
Newsroom
Security
Blog
API Docs
Integrations
Book a Demo
Careers