To get Medicare and Medicaid certification, you need a National Provider Identifier, the correct CMS-855 enrollment application filed through PECOS to your Medicare Administrative Contractor, and a separate enrollment with your state Medicaid agency. Along the way you have to clear licensing, civil rights, and screening checks that vary by provider type. Skip a step and the application gets returned; every day of delay is a day of patient services you cannot bill for.
What You Need in Place Before You Apply
Rushing to file before the basics are ready is one of the most common reasons applications stall. Get these pieces lined up first.
National Provider Identifier
Every provider needs an NPI before enrolling. It is a unique 10-digit number assigned through the National Plan and Provider Enumeration System and is required for all HIPAA-related billing and administrative transactions.1Centers for Medicare & Medicaid Services. National Provider Identifier Standard (NPI) Applying is free through the NPPES website or by mail. Online is faster.
State Licensing and Facility Standards
You must hold every state professional and facility license your practice type requires. CMS verifies licensing during enrollment and will not process an application tied to an expired or restricted license. Certain facilities face additional standards on top of licensing. Hospitals must meet Medicare’s Conditions of Participation, covering patient rights, infection control, emergency services, and more.2eCFR. 42 CFR Part 482 – Conditions of Participation for Hospitals Home health agencies, skilled nursing facilities, and hospices each have their own conditions.
Civil Rights Clearance
If you are applying for initial Medicare Part A certification or going through a change of ownership, you have to get a civil rights clearance from the HHS Office for Civil Rights. That means signing an Assurance of Compliance attesting that you will follow all applicable federal civil rights laws, submitted electronically through OCR’s Assurance of Compliance Portal.3HHS.gov. Civil Rights Clearance for Medicare Provider Applicants OCR no longer accepts paper forms or grants conditional approvals.
Documentation and an Operational Location
Have your business license, Employer Identification Number, and professional liability insurance documentation ready. You also need a qualified physical practice location that is open to the public, properly staffed, and equipped to provide the services you plan to bill for. If an on-site review shows you are not actually operational at the address on the application, CMS can deny it.
Choosing the Right CMS-855 Form
Medicare enrollment uses a family of CMS-855 forms. Submitting the wrong one gets your application returned.
- CMS-855A is for institutional providers: hospitals, skilled nursing facilities, home health agencies, hospices, critical access hospitals, end-stage renal disease facilities, federally qualified health centers, rural health clinics, and similar facility-based providers.4Centers for Medicare & Medicaid Services. CMS-855A Medicare Enrollment Application – Institutional Providers
- CMS-855B is for clinics, group practices, and certain other non-institutional organizations.
- CMS-855I is for individual physicians and non-physician practitioners such as nurse practitioners, physician assistants, and clinical social workers.
- CMS-855S is for suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS).
Each form asks for your legal business name, NPI, tax ID, practice location, ownership structure, and the services you intend to offer. Inconsistencies between what you put on the form and what appears in licensing databases will trigger delays, so make sure names, addresses, and numbers match exactly across every document before you send anything.
Submitting Your Medicare Application
Once the correct CMS-855 form is complete, you can submit through the Provider Enrollment, Chain, and Ownership System (PECOS) online or mail a paper version to your regional Medicare Administrative Contractor (MAC). Use PECOS. Web-based applications take roughly 30 days for the MAC’s initial review; paper takes about 65 days.5CMS. Enrollment and Certification Roadmap for Institutional Providers
MACs are private companies CMS contracts with to handle enrollment and claims processing for specific regions. Your MAC first reviews your application for completeness, then verifies you meet enrollment requirements. Depending on your provider type and risk category, this may include a site visit.
When Your Billing Privileges Start
For physicians, non-physician practitioners, ambulance suppliers, and several other categories, the effective date of billing privileges is the later of the date you filed your application or the date you first began providing services at the practice location listed on it.6eCFR. 42 CFR 424.520 – Effective Date of Medicare Billing Privileges Institutional providers that require a state survey or accreditation follow separate rules tied to that process. File as early as you can, because services you provide before your effective date generally cannot be billed.
Setting Up Payment
Medicare pays enrolled providers only through electronic funds transfer. Submit CMS Form 588 to your MAC at enrollment or during revalidation.7Centers for Medicare & Medicaid Services. Electronic Funds Transfer EFT Authorization Agreement Once EFT is in place, payments can arrive in as little as two weeks after claims are processed.8Centers for Medicare & Medicaid Services. Electronic Funds Transfer
Screening: How Much Scrutiny You Will Face
CMS assigns each provider type to one of three risk categories, and the screening intensifies with each tier.
- Limited risk: the MAC verifies you meet federal and state requirements, checks your licenses across state lines, and runs database checks before and after enrollment. Most established provider types sit here.9eCFR. 42 CFR 424.518 – Screening Levels for Medicare Providers and Suppliers
- Moderate risk: everything in the limited tier plus a mandatory on-site visit to verify the information on your application.
- High risk: everything in the moderate tier plus fingerprint-based FBI criminal background checks for every individual with a 5 percent or greater ownership interest.
Newly enrolling home health agencies, DMEPOS suppliers, MDPP suppliers, skilled nursing facilities, and certain opioid treatment programs are designated high-risk.10eCFR. 42 CFR 424.518 – Screening Levels for Medicare Providers and Suppliers If you are in that category, owners at the 5 percent threshold must submit fingerprints with the application or within 30 days of a contractor’s request. Missing the deadline means denial or revocation.
Medicaid uses a parallel risk-based system. State Medicaid agencies must conduct pre-enrollment and post-enrollment site visits for providers designated moderate or high risk.11eCFR. 42 CFR Part 455 Subpart E – Provider Screening and Enrollment
Fees and Bonds
Institutional providers and DMEPOS suppliers pay an enrollment application fee at initial enrollment, at revalidation, and when adding a new practice location. The 2026 fee is $750.12Federal Register. Medicare, Medicaid, and Childrens Health Insurance Programs Provider Enrollment Application Fee Amount for Calendar Year 2026 CMS adjusts it annually based on the Consumer Price Index. Physicians, non-physician practitioners, and their group organizations do not pay this fee.
DMEPOS suppliers have an additional requirement: a surety bond of at least $50,000, submitted at enrollment, at revalidation, and for each new practice location. CMS can require a higher bond when circumstances warrant.13Federal Register. Medicare Program Surety Bond Requirement for Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Technical Amendment
Enrolling with Medicaid
Medicaid enrollment is a separate process from Medicare and varies significantly from state to state because each state runs its own program. Visit your state Medicaid agency’s website for the specific forms, requirements, and submission methods. Some states have online portals; others still rely on paper applications.
Expect background checks on owners, managing employees, and certain provider types. The state agency reviews your credentials and may conduct site visits to confirm compliance with state regulations. Providers designated moderate or high risk under the federal framework will get those visits.11eCFR. 42 CFR Part 455 Subpart E – Provider Screening and Enrollment
After approval, you sign a provider agreement with the state Medicaid agency spelling out billing rules, recordkeeping obligations, and compliance requirements. Some states charge an application fee comparable to the Medicare fee; others do not.
If Your Application Is Denied
CMS can deny a Medicare application for specific reasons: noncompliance with enrollment requirements, false or misleading information, an unresolved Medicare debt, felony convictions within the preceding 10 years, a current payment suspension, failure to appear operational during a site visit, or an affiliation that CMS determines poses an undue risk of fraud.14eCFR. 42 CFR 424.530 – Denial of Enrollment in the Medicare Program Home health agencies can also be denied for failing to document sufficient initial reserve operating funds within 30 days of a request.
You have 60 days from the denial notice to request reconsideration. If reconsideration goes against you, you can request a hearing before an administrative law judge within 60 days of that decision.15eCFR. 42 CFR Part 498 – Appeals Procedures for Determinations That Affect Participation in the Medicare Program If your billing privileges were deactivated rather than revoked, you file a rebuttal instead.16eCFR. 42 CFR 424.545 – Provider and Supplier Appeal Rights The distinction matters: revocation is a penalty; deactivation is administrative and usually fixable.
Keeping Your Certification Active
Certification is not one and done. You have to revalidate on schedule and report changes on tight deadlines.
Revalidation
Medicare requires most providers and suppliers to revalidate every five years. DMEPOS suppliers revalidate every three years. PECOS is the fastest way to file.17Centers for Medicare & Medicaid Services. Revalidations (Renewing Your Enrollment) Institutional providers and DMEPOS suppliers owe the $750 application fee again at revalidation.
For Medicaid, federal regulations require state agencies to revalidate all providers at least every five years, regardless of provider type.18eCFR. 42 CFR 455.414 – Revalidation of Enrollment States can impose shorter cycles. Missing a revalidation deadline can deactivate your billing privileges.
Reporting Changes
Medicare deadlines for reporting are strict. Ownership changes, adverse legal actions, and changes to your practice location must be reported to your MAC within 30 days. All other enrollment changes must be reported within 90 days.19eCFR. 42 CFR 424.516 – Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status in the Medicare Program These apply to physicians, non-physician practitioners, their organizations, and every other provider type. Failing to report can lead to deactivation or revocation. Medicaid programs have their own reporting rules that vary by state; as a practical matter, report changes to both promptly.