Don't Wait for the Letter: What ED Groups Should Do Now About the CMS Medicaid Provider Revalidation Push

On April 23, CMS Administrator Mehmet Oz sent every governor and state Medicaid director the same letter on provider revalidation. The ask was direct: notify CMS within 10 business days whether the state will conduct a "swift revalidation" of high-risk Medicaid providers, and submit a comprehensive two-year provider revalidation strategy, signed by the state Medicaid director, within 30 days. Failure to act gets factored into federal assessments of fraud likelihood in that state's program.

Translation: every state Medicaid agency is now under federal pressure to demonstrate they are watching their provider rolls. That pressure is rolling downhill to providers right now.

If you run an ED physician group, here is the part most people are missing. You don't get to wait for your revalidation notice to start working on this. By the time the letter lands, the clock is already running, and a missed deadline doesn't just create paperwork. CMS guidance states that providers who fail to revalidate by the applicable deadline should not receive Medicaid payment between the due date and completion of screening.

That is a cash flow event, not a compliance event.

Why this is different from the routine 5-year cycle

State Medicaid agencies have always been required to revalidate every enrolled provider at least once every five years. That's the baseline under 42 CFR 455. What changed in April is the posture.

CMS has directed states to expedite Medicaid provider revalidation, with a focus on high-risk providers not screened in the past 12 months. States are being told to tighten screening, increase revalidation frequency, and use data analytics to confirm enrolled providers remain eligible. Providers with outdated enrollment information or gaps in National Provider Identifier use may face deactivation, denied claims, or payment holds if they cannot respond quickly to revalidation requests.

The phrase doing the work in that sentence is "respond quickly." Off-cycle revalidation means a shortened window. A group that has not kept its PECOS, NPPES, and state Medicaid enrollment data in sync is going to find itself scrambling to gather ownership disclosures, signatures, and supporting documents on a clock that does not care.

"High-risk" is broader than you think

Under federal regulations, physician groups and medical clinics sit at limited categorical risk. However, the state Medicaid agency must adjust the categorical risk level from "limited" or "moderate" to "high" when the state imposes a payment suspension based on credible allegation of fraud, waste, or abuse, when the provider has an existing Medicaid overpayment, or when the provider has been excluded by the OIG or another state's Medicaid program within the previous 10 years.

An ED group with an unresolved Medicaid overpayment of $1,500 or more that is over 30 days old can be elevated. A group with a single physician who appears on an exclusion list anywhere can be elevated. A group going through a recent ownership change can be elevated. And states have explicit authority to be more stringent than federal minimums.

The CMS letter signals that states will be looking harder, faster, and at a wider net of providers than they did a year ago.

What to do before the notice arrives

This is the part where having an independent set of eyes on your enrollment file pays for itself. Here is the work that needs to happen now, not when the revalidation notice arrives.

Reconcile PECOS, NPPES, and state Medicaid enrollment data. This is the single biggest preventable failure point. Practice locations, ownership percentages, authorized officials, banking information, specialty codes, and reassignments need to match across all three systems. A mismatch between what is in NPPES and what is in your state Medicaid file is exactly the kind of data analytics flag the new guidance is built to surface.

Refresh ownership and control disclosures. Under 42 CFR Part 455 Subpart B, state Medicaid agencies must obtain ownership and managing employee disclosures, and those need to reflect current reality. Any change in owners, managing employees, or addresses in the last 12 months needs a fresh disclosure on file. Build a clean, dated packet for the group and store it where you can find it on 30 days notice.

Run exclusion list checks on every provider, owner, and managing employee. OIG List of Excluded Individuals/Entities (LEIE), SAM.gov, and your state Medicaid exclusion list. Monthly is the right cadence. If you find a hit, you want to find it before the state does.

Audit your Medicaid overpayment status. Any unresolved overpayment over $1,500 that has aged past 30 days is a risk-level elevation trigger. If you have one sitting unaddressed, work it now.

Confirm every ED physician's individual Medicaid enrollment is current. Hospital-based ED groups sometimes assume the facility carries the enrollment burden. It does not. Every billing provider needs an active, accurate state Medicaid enrollment record, and every ordering or referring physician must be enrolled as a participating provider.

Designate a single owner inside the group for this work. Not the billing company. Not the credentialing service. Someone inside the practice who is accountable for knowing the next revalidation date for every provider, where the disclosure packet lives, and who responds when CMS or the state sends notice. The 5-year revalidation date for each provider should be tracked the same way you track licensure renewal.

The 12-month read

This federal push is not going to fade. The April letters are an opening move, not the whole game. States will be reporting back to CMS, the OIG will be watching, and the easier it is for a Medicaid agency to validate your group's enrollment data without back-and-forth, the less likely you are to end up in the slow lane when off-cycle revalidation rolls through your state.

For most ED groups, this is a project that takes a few weeks of focused attention to bring everything current, and then a quarterly maintenance cadence to keep it there. The cost of doing that work is small. The cost of having Medicaid payments suspended for 60 to 90 days while you scramble to complete a revalidation is not.

The best time to clean up your enrollment file was 12 months ago. The second-best time is before the letter arrives.

Tracy Bostrom is the President of Cigal Concepts, an embedded financial steward for emergency medicine.