What expires, and when

The map

Why they never line up

Each clock starts when its own paperwork was last completed, not on a date anybody chose. A provider credentialed in March re-attests in July; one credentialed in April re-attests in August. Multiply that by every provider on the roster and the calendar has no shape at all.

A firm holding twenty providers across a dozen client practices is therefore carrying somewhere near a hundred and twenty separate dates before a single payer enrollment is counted. That is the arithmetic that breaks a spreadsheet: not the number of rows, but that every row has its own unrelated timetable and no two of them can be checked together.

The ones that catch people out

CAQH runs on 120 days, and Illinois does not

The standard cycle is 120 days. Illinois runs 180 under state law, so a firm working across state lines is running two cadences on one profile type. The CAQH ProView quick reference is the primary document; the Illinois exception is described by HireGaynell and SybridMD, both of which are credentialing services rather than neutral parties.

A payer lapse is one payer, not all of them

NCQA sets re-credentialing at at least every 36 months, per payer, each on the date that provider was last approved by that payer. So a lapse takes out one payer's claims while the rest keep paying. Revenue dips instead of stopping, which is why these are routinely found by a denial rather than by a calendar.

DEA is three years, and it is per state of practice

The registration cycle is three years under 21 CFR 1301.13. A provider practising in two states holds two registrations with two dates. Renew late and prescribing stops, whatever the license says.

Board certification has no single cadence any more

The traditional cycle was ten years. Several boards have moved to five, some replaced the single decennial exam with small recurring online assessments, and some ask diplomates to attest in years 2, 4, 6, 8 and 10 of a ten-year cycle. In 2026 the program itself was renamed from Maintenance of Certification to Continuing Certification. The ABMS member-board directory is where each board’s current rule lives, and the American Board of Anesthesiology’s move to five years is a worked example of the shift.

For a firm this is the awkward one, because there is nothing to look up once. Twenty-four member boards means the answer depends on the provider’s specialty, and it has been changing.

Exclusion screening is not an expiry

Nothing on the provider's record runs out. The federal list changes monthly and the roster has to be re-checked against it, which is a different shape of task from everything else on this page and the reason it falls off calendars built for renewals. We publish the cost-of-lapse calculator for the money side of this; the screening side is a standing monthly job, not a date.

It is also not one list. The federal picture is OIG-LEIE plus SAM.gov, and most state Medicaid programs publish their own exclusion list on their own schedule and in their own format. A provider clear federally can be excluded by a state you bill in, so the monthly job is really as many checks as there are lists that touch your book.

Government enrollments are the ones people lose

Medicare revalidation runs on a five-year cycle for most providers and three for DMEPOS suppliers, set by 42 CFR Part 424 Subpart P and described on CMS’s own revalidation page. State Medicaid programs revalidate at intervals not exceeding five years, three for DME, to the same federal ceiling.

Five years is the problem. It is longer than most spreadsheets survive, longer than most staff stay in a role, and long enough that the person who filed the original enrollment has usually moved on. CMS also reserves the right to request revalidation off-cycle, so the date you recorded is a floor rather than a promise.

One provider’s year, as it actually falls

Take a physician credentialed in March, licensed in one state, prescribing controlled substances, enrolled with Medicare and fifteen commercial payers.

• March. Credentialed. Every clock below starts on a different date from this one.
• July. First CAQH re-attestation falls due, 120 days on.
• Every month, all year. Exclusion screening against a list that changed since last month.
• November. Second re-attestation. Nothing else has happened yet, which is what makes the year feel quiet.
• Somewhere in year two or three. Malpractice renews on the policy term. The state board wants a renewal on its own cycle. Neither is aligned to anything else.
• Year three. DEA. Also the earliest a commercial payer re-credentials, and each of the fifteen has its own date.
• Year five. Medicare revalidation, by which point three of the dates above have rolled twice.

Nothing in that list is difficult. The difficulty is that it is one provider, and a firm at twenty providers is running twenty non-overlapping copies of it.

The practice that actually works

Credentialing specialists who publish on this converge on one habit: never work to the deadline itself. Set the internal trigger at 90 days against CAQH’s 120, so there are 30 days of slack to chase a malpractice certificate or a license renewal that is still in the post. The advice comes from HireGaynell, a credentialing service, and it matches what the enrollment timelines make necessary: restoring a lapsed payer enrollment takes 90 to 120 days, so anything found on the day it lapses is already months from being fixed.

What we do and do not do about it

RosterSafe tracks these dates across every provider and client practice on one timeline, and tells you before they pass. That is the whole product.

It does not file anything, does not attest on your behalf, and does not discharge your responsibility for your own deadlines. We are deliberately not a credentials verification organization: the firm keeps control, the margin, and the client relationship. If what you want is for somebody else to do the work, an outsourced service is the right purchase and we are not it.

See it on your own roster