DMEPOS Revalidation Every Three Years

Enrollment is not permanent. "A supplier must revalidate its application for billing privileges every 3 years after the billing privileges are first granted," and "Each supplier must complete a new application for billing privileges 3 years after its last revalidation" (42 CFR 424.57(g)). Most other Medicare providers revalidate every five years; the CMS Program Integrity Manual notes the DMEPOS cycle is "every 3 years." CMS can also order off-cycle revalidations.

When will the revalidation notice come?

PECOS sets the schedule. According to the manual (chapter 10, section 10.4.5.1), PECOS determines each supplier's due date and sends a revalidation notice "between 90 to 105 days prior to the provider/supplier's revalidation due date." Paper filers get the notice by email through PECOS and may still revalidate on paper. Notices go to the revalidation address in section 4C of your 855S, which "cannot be a billing agency, Management Services Organization, or the supplier's representative," so keep that address current.

Can I revalidate early?

Not on your own schedule. The 855S says: "Do not submit an application for revalidation until you have been contacted by the contractor." The manual tells contractors to return unsolicited revalidation applications, and if one arrives more than 7 months before the due date it is returned on that basis, with any fee refund requested. PECOS will not accept a revalidation outside its window.

Extensions are rare. The manual lets a contractor accept an extension request only from a supplier "that was not given the full 7 months' advance notice prior to their revalidation due date," and for no other reason.

What does a DMEPOS revalidation include?

It is a full application. Section 1A of the 855S tells revalidating suppliers to complete all sections. The pieces that trip people up:

• The fee. Revalidations require the application fee, $750 for applications submitted in 2026 (CMS-6096-N). See the 2026 application fee.
• The bond. A supplier "responding to a revalidation or reenrollment request must submit ... a surety bond," and the elevated amount is recalculated from adverse legal actions in the 10 years before revalidation (424.57(d)(2)(i) and (d)(3)(ii)).
• Current accreditation for every product listed, which since 2026 means an accreditation renewed within the last 12 months for suppliers on the annual cycle (424.57(c)(24)).
• Current licenses for each state and product in section 2D and 2E, and a current liability insurance certificate naming the enrollment contractor.
• The signature. For an organization, the initial application and every periodic revalidation "must be signed by an authorized official" (424.510(d)(3)(ii)), the same rule as the initial enrollment. A delegated official may sign changes reported between revalidations, not the revalidation itself.

Is there screening at revalidation?

Yes. Revalidating DMEPOS suppliers are "moderate" risk under 42 CFR 424.518(b)(1)(ix) if they were fingerprinted at initial enrollment, which means an on-site visit; the manual says "A site visit of the DMEPOS supplier shall be conducted prior to" a final revalidation decision. Suppliers whose fingerprinting was waived at enrollment during a declared emergency are screened at the high level and fingerprinted at revalidation (424.518(c)(1)(viii)). See the site visit checklist.

What if the contractor asks for more?

The manual tells contractors to develop for everything missing in one request and gives the supplier 30 days to respond. For PECOS applications, the response goes in through PECOS.

What happens if I miss the due date?

CMS can deactivate billing privileges when a supplier does not furnish complete information within 90 calendar days of a request to submit an enrollment application (42 CFR 424.540(a)(3)), and Medicare does not pay for items furnished while deactivated (424.540(e)). It can also revoke for noncompliance under 424.535(a)(1). There is one mercy in the revocation rules: the reenrollment bar "Does not apply in the event a revocation of Medicare enrollment is imposed under paragraph (a)(1) ... based upon a provider's or supplier's failure to respond timely to a revalidation request" (424.535(c)(1)(ii)).

Coming back costs money either way. The manual says a supplier deactivated for not responding to a revalidation request resubmits a revalidation, not a reactivation, so the fee applies. A reactivating non-exempt supplier must also be accredited. Revalidation is the easier path.

How do you keep revalidation routine?

1. Report every change within 30 days as it happens, so the revalidation is a confirmation, not a catch-up (see the 30-day rule).
2. Track each location's due date in PECOS; multi-location suppliers often have several.
3. Keep the bond continuous, and confirm the bond amount still matches your adverse action history.
4. Line up the annual accreditation resurvey so it does not lapse during revalidation.
5. Check every state license listed in section 2D, especially for mail-order suppliers shipping to many states.

Practitioners enrolled on the 855I or 855B follow a different cycle; our sister company White Glove Credentialing explains it in Medicare revalidation for providers.

What does it cost to have us handle revalidation?

Medicare Revalidation is $595 (see pricing). We reconcile your PECOS record with your current licenses, bond, insurance and accreditation, prepare the 855S, prepare the location for the site visit and, as your approved PECOS surrogate, submit it; your authorized official signs. The CMS fee and bond premium are paid by you directly. License Renewal Tracking ($299 per license, per year) keeps the state side current between revalidations.