To get a Medicaid Provider ID number, you enroll through your state’s Medicaid agency: submit an application with your National Provider Identifier, tax ID, and ownership disclosures, pass the screening that matches your risk category, and pay the $750 application fee if you’re an institutional provider. Most clean applications take a few weeks to a few months, and the state issues your provider ID with an effective date once you’re approved.
Federal regulations set the baseline every state follows, but your state Medicaid agency can add requirements on top of that. Start on your state agency’s website for the specific forms, portal, and provider types it accepts.
Confirm You’re Eligible to Enroll
Physicians, dentists, therapists, hospitals, clinics, pharmacies, home health agencies, nursing facilities, and many other healthcare professionals and organizations can enroll. You need a valid state license for your profession or facility type, and some categories require specific certifications or accreditation before the state will approve you.
Before you spend time on the application, check the Office of Inspector General’s List of Excluded Individuals and Entities. If you or anyone with a 5 percent or greater ownership interest in your practice appears on that list, your enrollment will almost certainly be denied, and hiring or contracting with a listed person exposes your organization to civil monetary penalties.
Documents to Gather Before You Start
Missing a document can restart the clock, so pull everything together before you open the enrollment form.
National Provider Identifier
Nearly every healthcare provider needs an NPI before applying. It’s a 10-digit number required for HIPAA-standard billing transactions, and you get it for free through the National Plan and Provider Enumeration System at nppes.cms.hhs.gov. CMS recommends the online application for the fastest processing. A small number of non-healthcare Medicaid providers, such as specialized medical vehicle companies, are exempt and receive a Medicaid-specific number instead.
Tax ID and Business Details
Have your federal tax identification number ready. Organizations and group practices use an Employer Identification Number; individual practitioners typically use their Social Security Number. State and federal law require a valid SSN from every individual applying for a Medicaid provider number, and an incorrect one can get your application rejected outright. You’ll also need state professional license numbers, business entity registration details, practice addresses, and contact information.
Ownership and Control Disclosures
Federal rules require you to disclose every person with a 5 percent or greater direct or indirect ownership or control interest in your organization. For each, provide name, address, and Social Security Number or date of birth. You also have to disclose whether any of those individuals are related to each other as spouses, parents, children, or siblings, and whether any hold ownership or management roles in other healthcare entities that participate in Medicare or Medicaid. Criminal convictions or sanctions related to a federal healthcare program must be reported too.
Know Your Risk Category
CMS assigns every provider type to one of three risk categories, and the category determines how much scrutiny your application gets. States can also move a provider into a higher tier based on their own fraud concerns.
- Limited risk covers most physicians, non-physician practitioners, hospitals, pharmacies, ambulatory surgical centers, and federally qualified health centers. Screening verifies that you meet federal and state requirements, checks your license in every state where you hold one, and runs database checks against exclusion lists and other enrollment records.
- Moderate risk covers ambulance suppliers, community mental health centers, independent clinical laboratories, independent diagnostic testing facilities, and physical therapy practices. You get everything in the limited tier plus an unannounced on-site visit.
- High risk covers newly enrolling home health agencies, durable medical equipment suppliers, skilled nursing facilities, and hospices. In addition to the limited and moderate steps, every owner with a 5 percent or greater interest must submit fingerprints for a criminal background check within 30 days of the request.
If you’re opening a new home health agency or DME company, expect the process to take longer and require more documentation than a physician enrolling a solo practice.
Submit the Application and Pay the Fee
Most state Medicaid agencies offer an online enrollment portal where you create an account, complete the application, upload supporting documents, and submit electronically. A handful of states still accept paper applications by mail, but electronic submission is faster and gives you a tracking number.
Institutional providers, such as hospitals, nursing facilities, and home health agencies, pay an application fee when initially enrolling, revalidating, or adding a new practice location. For 2026 the fee is $750, and CMS adjusts it annually based on the Consumer Price Index. Individual physicians and non-physician practitioners don’t pay it. Institutional providers who have already paid the fee to Medicare or to another state’s Medicaid program can skip it. Most portals accept credit card, debit card, or electronic funds transfer.
Check for a Moratorium First
CMS can impose temporary moratoria that block new enrollments for specific provider types or geographic areas where fraud risk is elevated. Moratoria run in six-month increments and can be extended. A state can also request its own moratorium with CMS approval. If applications for your provider type aren’t being accepted, a moratorium may be the reason, so check with your state Medicaid agency or the CMS website before you invest time in an application.
What Happens After You Apply
Processing times vary widely. Some states turn around clean applications in a few weeks; others take several months. If your application is incomplete or raises questions during screening, the agency will request more information and the clock essentially restarts once you respond. Many state portals let you check status online using your tracking number and tax ID.
When your application is approved, you’ll get a notification by email or formal letter with your state-specific Medicaid Provider ID number and an effective date. For accredited providers who were already furnishing covered services before approval, the effective date can be set retroactively for up to one year, which can cover unpaid services you delivered to Medicaid beneficiaries during that window. The specific rules depend on whether you’re subject to additional federal or state requirements beyond your accreditation.
Why Applications Get Denied
The state Medicaid agency must deny or terminate enrollment if any person with a 5 percent or greater ownership interest has a criminal conviction related to Medicare, Medicaid, or CHIP within the last 10 years. Enrollment will also be denied if you or an owner submits inaccurate information, refuses to cooperate with screening, declines a site visit, or doesn’t provide fingerprints within 30 days when requested. Falsifying any information on the application is independent grounds for denial. Each state has its own appeals process for contesting a decision.
Managed Care Credentialing Is a Separate Step
In most states, the majority of Medicaid beneficiaries get care through managed care organizations rather than traditional fee-for-service Medicaid. Your state-issued Medicaid Provider ID is the necessary first step, but many managed care plans require a separate credentialing process before they’ll add you to their network and pay your claims. Contact the managed care organizations operating in your state for their specific credentialing requirements and timelines. Enrolling with the state agency alone won’t guarantee you can bill for every Medicaid patient who walks through your door.
Keeping Your Provider ID Active
Your Medicaid Provider ID doesn’t last forever without maintenance. Federal regulations require every state to revalidate every provider’s enrollment at least once every five years. Revalidation updates and re-verifies the information in your file, and the screening requirements for your risk category apply again. Missing a revalidation deadline can result in termination.
Between cycles, you’re responsible for reporting changes. Notify your state Medicaid agency promptly when your practice address, ownership structure, or contact information changes. You also have to report adverse legal actions such as license restrictions or criminal convictions involving owners or managing employees. Failing to keep your enrollment information current is one of the grounds a state can use to terminate your participation.