Written and maintained by CASRAI Editorial Board
Last updated
Short answer: Medicare revalidation is the periodic renewal of a supplier’s enrollment record. Most Medicare providers revalidate every five years, but durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) suppliers revalidate every three years under 42 CFR 424.57(g). CMS says that missing a revalidation can lead to a payment hold or deactivation of billing privileges. This guide is general regulatory information, not legal or compliance advice.
Definition and scope
Medicare revalidation (also searched as “Medicare revalidation DME”) means resubmitting and certifying the accuracy of the enrollment information a supplier gave CMS when it obtained billing privileges. For DMEPOS suppliers the rule sits in 42 CFR 424.57(g): a supplier “must revalidate its application for billing privileges every 3 years after the billing privileges are first granted,” and each supplier “must complete a new application for billing privileges 3 years after its last revalidation.”
The general revalidation rule, 42 CFR 424.515, sets a five-year cycle for providers and suppliers but carves DMEPOS suppliers out: they “must continue to renew enrollment in accordance with 424.57(g).” Paragraph (e) of 424.515 also lets CMS require off-cycle revalidation, and it describes the DMEPOS cycle as the “3-year DMEPOS supplier revalidation cycle.”
How revalidation works in practice
Which application is used
Under 424.57, the DMEPOS enrollment application is the CMS-855S (OMB number 0938-1056), submitted on paper or electronically. The same rule says the application is also used when a supplier responds to a revalidation request, and that a surety bond must accompany the application when a supplier responds to a revalidation or reenrollment request. For the bond itself, see the related guide on DMEPOS supplier standards.
Where CMS says to file
On its Revalidations page (checked 2026-10-30), CMS describes PECOS, its online enrollment system, as “the most efficient way to submit your revalidation,” since it is paperless and lets the supplier review information on file, upload supporting documents and sign electronically.
Due dates and notices
CMS states that revalidation due dates appear on the Medicare Revalidation List, posted seven months in advance. The enrollment contractor sends a notice by email or postal mail about three to four months before the due date. DMEPOS suppliers are notified by the National Provider Enrollment DMEPOS East and West contractors, whereas Medicare Administrative Contractors notify providers, group practices and non-DMEPOS suppliers. CMS adds that the supplier remains responsible for keeping track of its own due date.
Revalidation timeline: windows and who sets them
The numbers below come from three different sources, and they answer different questions. Reading them together avoids a common mix-up between the renewal cycle, the response deadline and change reporting.
| Window | What it governs | Source |
|---|---|---|
| Every 3 years | DMEPOS supplier revalidation cycle; a new application 3 years after the last revalidation | 42 CFR 424.57(g); 424.515(e) |
| 7 months ahead | CMS posts due dates on the Medicare Revalidation List; unsolicited revalidations filed when the due date is more than seven months away are returned unless a notice was received | CMS Revalidations page |
| 3 to 4 months before due date | Typical timing of the email or mailed revalidation notice | CMS Revalidations page |
| Within 3 months of due date | CMS says to revalidate when within three months of the due date, even without a notice | CMS Revalidations page |
| 60 calendar days | Time to submit a complete application after CMS notifies the supplier to resubmit and certify | 42 CFR 424.515(a)(2) |
| 90 days | Minimum advance notice CMS gives affected providers and suppliers before changing the routine revalidation schedule | 42 CFR 424.515(d) |
| 30 days | Time to report changes in enrollment information; this is separate from revalidation | 42 CFR 424.57(c)(2) |
Where it matters for labs, clinics and supply decisions
CMS states that failing to revalidate on time could result in a hold on Medicare reimbursement or deactivation of billing privileges, that reactivation requires a new complete enrollment application, and that Medicare does not reimburse for services during the deactivation period. It also states there are no exemptions from revalidation and that CMS does not grant extensions.
For a clinic or laboratory that relies on a DMEPOS supplier for items patients receive under Medicare, the practical reading of those rules is that a supplier’s Medicare billing can stop if its enrollment lapses. That is an interpretation of the rules above, not a CMS statement about any particular supplier. Procurement teams that already screen vendors can place enrollment status alongside the checks described in debarment and exclusion screening and in vendor scorecard metrics. For how Medicare treats the equipment itself, see Medicare DME coverage.
Common misunderstandings
Revalidation is not the same as reporting a change
Under 424.57(c)(2) a supplier must report changes to its application information within 30 days of the change. That obligation runs on its own clock and does not replace or reset the three-year revalidation.
DMEPOS suppliers are not on the five-year cycle
The five-year cycle on many general explainers applies to most providers and suppliers. 42 CFR 424.515 expressly excludes DMEPOS suppliers and points to the three-year rule in 424.57(g).
Filing early is not always accepted
CMS says that if the due date is more than seven months away and no revalidation notice has been received, an unsolicited revalidation will be returned.
CMS may also ask for off-cycle revalidation
The three-year date is not the only trigger: 424.515(e) allows CMS to require revalidation outside the routine cycle, and the CMS page says the agency reserves the right to request off-cycle revalidations.
FAQ
How often must a DME supplier revalidate with Medicare?
Every three years. 42 CFR 424.57(g) requires a new application for billing privileges three years after the supplier’s last revalidation.
How does a DME supplier find its revalidation due date?
CMS publishes due dates on the Medicare Revalidation List, posted seven months in advance, and the DMEPOS enrollment contractors send notices about three to four months ahead of the due date.
What happens if a DMEPOS supplier does not revalidate?
According to CMS, billing privileges can be deactivated or payment held. Reactivation requires a new complete enrollment application, and Medicare does not pay for services furnished while deactivated.
How long does a supplier have to respond to a revalidation request?
Under 42 CFR 424.515(a)(2), within 60 calendar days of CMS notifying the supplier to resubmit and certify its enrollment information.
Sources
- 42 CFR 424.57, Special payment rules for items furnished by DMEPOS suppliers and issuance of DMEPOS supplier billing numbers, via Cornell LII: law.cornell.edu/cfr/text/42/424.57 (date checked: 2026-10-30).
- 42 CFR 424.515, Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information, via Cornell LII: law.cornell.edu/cfr/text/42/424.515 (date checked: 2026-10-30).
- CMS, Revalidations (Medicare enrollment and renewal): cms.gov revalidations page (date checked: 2026-10-30).
