Recredentialing: How Payer Re-Review Works and What to Track

Published October 30, 2026

TL;DR

  • Recredentialing is a payer's periodic re-review of a provider it has already credentialed. Medicare Advantage plans must recredential at least every 3 years under 42 CFR 422.204, NCQA requires recredentialing every three years, and large payers such as UnitedHealthcare and Aetna state the same cycle.
  • It is one of three separate clocks. CAQH re-attestation is due every 120 days (180 in Illinois), and Medicare revalidation every 5 years (3 for DMEPOS suppliers); Medicaid must revalidate providers at least every 5 years.
  • Missing any of them has a different consequence: a lapsed recredentialing can end network participation, an expired CAQH attestation stalls the payer's review, and an unanswered Medicare revalidation request can lead to deactivation with no payment for services furnished while deactivated.
  • Track each provider, payer and program on its own due date, and keep the CAQH profile current between cycles, because payers re-verify from it.

A credentialing coordinator at a growing group usually learns about recredentialing the hard way: a letter from a payer saying a long-tenured physician's participation is ending because the recredentialing packet was never returned. The physician was never out of network on purpose. The request went to an old address, or sat in a shared inbox, or was mistaken for the CAQH reminder the team had already handled.

Recredentialing is routine work, but it runs alongside two other renewal processes that sound similar and are not. This guide explains what payers re-review, how often, how it differs from CAQH re-attestation and government revalidation, and what to track so none of the three lapses.

What recredentialing is

Credentialing is how a payer verifies a provider's qualifications before admitting them to its network. Recredentialing repeats and updates that review on a fixed cycle for providers already in the network.

The federal rule for Medicare Advantage shows what it covers. Under 42 CFR 422.204, an MA organization must have written credentialing and recredentialing policies. Initial credentialing includes a written application, verification of licensure or certification from primary sources, disciplinary status, eligibility for payment under Medicare and site visits as appropriate. Recredentialing must happen "at least every 3 years," must update the information obtained during initial credentialing, and must consider performance indicators such as those collected through quality improvement programs, utilization management systems, grievances and appeals, and enrollee satisfaction surveys. It also requires an attestation of the correctness and completeness of the new information.

That last requirement is the practical difference from a paperwork renewal. Recredentialing is a fresh decision about whether the provider stays in the network, and the payer can take the provider's history during the cycle into account.

How often payers recredential

Three years is the common cycle, and it comes from several directions at once. NCQA, whose credentialing standards many health plans are accredited against, states that it "requires recredentialing every three years." Large payers publish the same interval:

  • UnitedHealthcare's Credentialing Plan for 2025 to 2027 says licensed independent practitioners "will be Recredentialed at least every 36 months."
  • Aetna's provider manual says that to continue to participate, providers must be recredentialed every three years, unless state or federal regulations or accrediting standards require otherwise.
  • Cigna says each provider undergoes reassessment at least every three years, and its newer guidance says recredentialing is required every three years in most states.

Medicaid managed care is set by the state. Federal rule 42 CFR 438.214 requires each state to establish a uniform credentialing and recredentialing policy and requires every Medicaid managed care plan to follow a documented process, but it does not set a federal interval. Check the state's policy and each plan's contract.

What payers look at during recredentialing

The core of the review is re-verifying the items checked at initial credentialing: licensure, board certification where relevant, malpractice history, sanctions and exclusions, and the information in the provider's application. UnitedHealthcare's plan, for example, looks at the past three years of malpractice history or a National Practitioner Data Bank query, requires that the provider has complied with the terms of the participation agreement, including completing any improvement action plans, and says a history of quality-of-care concerns within the cycle may lead to denial of recredentialing.

Plans also monitor between cycles. For NCQA-accredited health plans, NCQA's corrections to its 2025 standards changed adverse-event monitoring from at least every six months to at least monthly starting July 1, 2025, and revised the time frame for reviewing sanction, exclusion, limitation and expiration information to include at least every 30 calendar days. NCQA also shortened several primary-source verification time limits for files processed on or after July 1, 2025; the malpractice history limit for health plans, for instance, went from 365 to 180 calendar days. The practical effect for providers is that the information a payer holds is refreshed more often than the three-year cycle suggests.

Recredentialing is not CAQH re-attestation

Most commercial payers pull a provider's application data from the CAQH Provider Data Portal (still hosted at proview.caqh.org; CAQH now operates as DataSpring). CAQH's provider user guide says re-attestation "is required every 120 days (180 days for Illinois providers)" to keep data accurate for health plan use. If no re-attestation occurs, the provider is put in "Expired" status on the day after it was due, followed by reminders and a final notice 42 days later.

Re-attestation and recredentialing are linked but separate. UnitedHealthcare's credentialing FAQ says it starts recredentialing automatically near the 3-year mark and that, if a provider maintains a complete and current application and attests every 120 days, "there's nothing you need to do," though it will contact providers in states that require additional information. It also says that if recredentialing is not completed, the provider may not be eligible to continue to participate in the network. Aetna's manual asks providers to designate Aetna as an authorized plan to access their CAQH application. A stale profile does not end participation by itself, but it is what the payer reads when its cycle comes due. Our guide to CAQH profile maintenance and re-attestation covers what teams most often miss.

Recredentialing is not Medicare or Medicaid revalidation

Revalidation is the government enrollment equivalent, and it governs billing privileges rather than network participation. Under 42 CFR 424.515, a provider or supplier other than a DMEPOS supplier must resubmit and recertify its Medicare enrollment information every 5 years, and DMEPOS suppliers revalidate every 3 years. CMS contacts each provider when it is time to revalidate and may also run off-cycle revalidations.

CMS's revalidation page says it posts due dates seven months in advance and that contractors send a notice about three to four months before the due date. CMS does not grant extensions, and missing the deadline may result in a hold on Medicare reimbursement or deactivation of billing privileges. Under 42 CFR 424.540, CMS may deactivate a provider that does not furnish complete information within 90 calendar days of a revalidation request, and a provider "may not receive payment for services or items furnished while deactivated." A due date shown as "TBD" in CMS's revalidation lookup means CMS has not set one yet, and CMS asks providers not to submit an unsolicited application.

Medicaid has its own cycle. Under 42 CFR 455.414, the state Medicaid agency must revalidate the enrollment of all providers regardless of provider type, at least every 5 years. Our guide to provider enrollment follow-up covers what to watch while an enrollment or revalidation application is pending.

Three clocks, side by side

Payer recredentialingCAQH re-attestationMedicare and Medicaid revalidation
Who runs itEach health plan, or its delegateThe provider, in the CAQH Provider Data PortalCMS through the MAC; the state Medicaid agency
How oftenTypically every 3 yearsEvery 120 days (180 in Illinois)Medicare every 5 years (3 for DMEPOS); Medicaid at least every 5 years
What it protectsNetwork participation with that payerA current application payers can rely onBilling privileges in the program
If missedPossible termination from the networkProfile moves to Expired statusPossible payment hold or deactivation

What to track

The failures in recredentialing are almost always tracking failures, so the tracking model matters more than any single deadline. A useful credentialing calendar keeps a separate row for every combination that has its own clock:

  • each provider's recredentialing due date with every payer, and the date the payer's request arrived;
  • the CAQH re-attestation date for each provider, and which plans are authorized to view the profile;
  • Medicare revalidation due dates per enrollment record, since one NPI can have more than one record with different dates;
  • each state Medicaid revalidation date;
  • license, DEA and board certification expirations, which payers re-verify during the cycle;
  • the contact and mailing address each payer uses for credentialing notices.

Monitoring exclusions between cycles is part of the same discipline. The HHS Office of Inspector General notes that there is no statutory or regulatory requirement for providers to check its exclusion list, but because the list is updated monthly, monthly screening best minimizes potential overpayment and civil monetary penalty liability.

Confirming status with the payer

The step that most often fails is the last one: confirming that a payer actually received and completed a recredentialing file. Status is not always visible in a portal, and a missing document can sit unflagged until the cycle closes. Cigna Behavioral Health's provider manual (2021 edition), for example, says that if a provider has not re-attested in CAQH consistently, Cigna will contact them six months before the recredentialing date, make at least two outreach attempts, and send a pre-termination notice by certified mail if the provider does not respond.

Following up before that point is mostly calls to credentialing departments, asking what the payer has, what is missing and when the decision is expected. SuperDial automates those payer follow-up calls for credentialing and enrollment teams, returning each payer's answer as structured data with the call recording and transcript.

FAQ

How often is recredentialing required?

Usually every three years. Medicare Advantage plans must recredential at least every 3 years under federal rules, NCQA requires recredentialing every three years, and major commercial payers publish the same cycle. Medicaid managed care cycles are set by each state.

What is the difference between credentialing and recredentialing?

Credentialing is the initial review a payer performs before admitting a provider to its network. Recredentialing repeats that review on a fixed cycle, updating the verified information and considering the provider's record during the period, such as quality concerns and complaints.

Is CAQH re-attestation the same as recredentialing?

No. Re-attestation confirms the provider's CAQH data every 120 days (180 in Illinois). Recredentialing is each payer's own periodic decision, which typically relies on that CAQH data.

Is Medicare revalidation the same as recredentialing?

No. Revalidation renews Medicare enrollment and billing privileges every 5 years, or every 3 years for DMEPOS suppliers. Recredentialing is a health plan's review for network participation, including Medicare Advantage plans.

What happens if recredentialing is not completed?

The payer may end the provider's network participation. UnitedHealthcare, for example, says a provider who does not complete recredentialing may not be eligible to continue to participate in its network.

Sources

Run a pilot on a real workflow.

Bring a representative batch, define the output schema, and validate ROI with your payer mix in 30 to 90 days.

Book a Demo
Superdial white logo
The communication layer for revenue cycle teams.
Workflows
Benefits Verification
Prior Authorization
Claim Status
Credentialing & Enrollment
Provider Data Management
Who We Serve
RCM Companies
Provider Groups
Orthopedics
Gastroenterology
Dental & DSOs
Health Systems
Payers
Digital Health
Pharma
Company
Case Studies
Newsroom
Security
Blog
API Docs
Book a Demo
Careers