Last updated: November 2026
A Medicaid provider enrollment and revalidation program is the standing process that keeps every state Medicaid enrollment a provider group holds current, accurate and ready for screening. It exists because 42 CFR Part 455 Subpart E puts screening, revalidation and termination duties on each State Medicaid agency, and those duties reach you as requests: disclosures, fingerprints, site access and revalidation applications. Integral Healthcare Solutions (IHS) is a consulting firm. It drafts the enrollment inventory, disclosure worksheets, packets and calendar, and your authorized official signs and submits them.
This is compliance services work, one of three IHS practice lines. It is not legal advice.
What does the federal Medicaid enrollment rule require?
Subpart E sets duties for the State Medicaid agency, and in practice each reaches a provider as a request or a deadline. The source is 42 CFR Part 455 Subpart E in the current electronic CFR text published by the Government Publishing Office on govinfo (data set dated October 2026; opened November 4, 2026). This page stays on the federal subpart. State forms, cycles and fees vary and were not reviewed.
How often must a provider revalidate?
“The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.” (section 455.414). Five years is the longest gap the rule allows. A state can ask sooner: section 455.452 says nothing in the subpart restricts the agency from establishing “provider screening methods in addition to or more stringent than those required by this subpart.”
How deep is the screening, and who sets the level?
Section 455.450 has the agency screen every initial application, “including applications for a new practice location,” and any application received in response to a re-enrollment or revalidation request, at a “limited,” “moderate,” or “high” categorical risk level, and “the highest level of screening is applicable” if a provider could fit more than one. Each level adds to the one below:
- Limited: verify federal and state requirements for the provider type before the enrollment decision, verify licenses (including licensure in other states), and run database checks before and after enrollment (section 455.450(a)).
- Moderate: limited plus on-site visits under section 455.432 (section 455.450(b)).
- High: limited and moderate plus a criminal background check and fingerprints under section 455.434 (section 455.450(c)).
The state sets the categorical risk levels (section 455.434(b)). Under section 455.450(e) it must raise a provider from limited or moderate to high when it imposes a payment suspension based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years, and for a provider that a temporary moratorium on its provider type had kept out, if the state or CMS lifted the moratorium in the previous 6 months and the provider applies within 6 months from the date it was lifted.
What do site visits, fingerprints and database checks involve?
Section 455.432(a) requires pre-enrollment and post-enrollment site visits of providers designated “moderate” or “high” categorical risks, and section 455.432(b) says the agency “Must require any enrolled provider to permit CMS, its agents, its designated contractors, or the State Medicaid agency to conduct unannounced on-site inspections of any and all provider locations.”
Section 455.434(b)(2) puts fingerprints on a clock: a provider, or any person with a 5 percent or more direct or indirect ownership interest, must submit a set “within 30 days upon request from CMS or the State Medicaid agency.”
Section 455.436(c)(2) says the agency must “Check the LEIE and EPLS no less frequently than monthly.” That check is the agency’s duty. Section 455.436(a) reaches persons with an ownership or control interest and agents and managing employees, so your data on them must be right.
What happens when a disclosure, fingerprint set or site visit goes wrong?
Section 455.416(a) requires termination where a person with a 5 percent or greater direct or indirect ownership interest “did not submit timely and accurate information and cooperate with any screening methods required under this subpart.” Section 455.416(e) says the agency “Must terminate or deny enrollment if the provider, or any person with a 5 percent or greater direct or indirect ownership interest in the provider, fails to submit sets of fingerprints in a form and manner to be determined by the Medicaid agency within 30 days of a CMS or a State Medicaid agency request, unless the State Medicaid agency determines that termination or denial of enrollment is not in the best interests of the Medicaid program and the State Medicaid agency documents that determination in writing.” Section 455.416(f) applies the same exception to a provider that fails to permit site visit access.
Section 455.416(c), as amended effective January 1, 2026 (90 FR 55619), can carry a termination across states. It says the agency “Must deny enrollment or terminate the enrollment of any provider that is terminated on or after January 1, 2011, under title XVIII of the Act or under the Medicaid program or CHIP of any other State, and is currently included in the termination database under § 455.417.” Providers terminated or denied under section 455.416 get “any appeal rights available under procedures established by State law or regulations” (section 455.422).
Who needs a Medicaid enrollment program, and what triggers it?
A provider group, health center or multi-site practice enrolled in two or more state Medicaid programs needs one, because each state keeps its own dates and forms. The usual triggers are a revalidation request, a new practice location, a new owner or managing employee, a deactivation that needs re-screening (section 455.420), and a fingerprint or site visit request.
How does IHS help?
IHS builds the program around one calendar and one set of accurate disclosures, led by Thomas G. Goddard, JD, PhD. The steps:
- Build an enrollment inventory of each state, provider and location, with dates.
- Draft disclosure worksheets for owners, managing employees and locations, so one set of facts feeds every state form.
- Prepare enrollment and revalidation packets from your state forms.
- Draft fingerprint and site visit response plans with named owners.
- Build a revalidation calendar from each state’s dates, plus an internal exclusion screening schedule your compliance lead approves.
What you supply. State forms, license records, owner and board lists, location details and signatures. Your authorized official submits, and counsel handles any termination, denial or appeal.
The real limit. States differ, and this page rests on the federal subpart only. A packet is only as accurate as the disclosures people give. IHS does not submit packets or deal with any state Medicaid agency.
What to have ready
Each item ties to 42 CFR Part 455 Subpart E (current text, page opened November 4, 2026) and to each state’s forms.
- Every state enrollment, with each enrollment or last revalidation date (section 455.414).
- Every person with a 5 percent or greater direct or indirect ownership interest, plus managing employees (sections 455.416(a) and 455.436(a)).
- A named person who can get fingerprints in within 30 days (section 455.434(b)(2)).
- A site visit contact for every address (section 455.432(b)).
- New practice location details before you file (section 455.450).
- Suspension, overpayment, exclusion or moratorium history (section 455.450(e)).
- Any past termination or deactivation (sections 455.416(c) and 455.420).
- Application fee status in each state (section 455.460), and counsel for terminations, denials and appeals (section 455.422).
The free introductory call turns that list into a calendar.
How does state reliance on Medicare and other states change the work?
Under section 455.410(c) the agency “may rely on the results of the provider screening performed by” Medicare contractors or other States’ Medicaid agencies or Children’s Health Insurance Programs. The word is “may,” so your state decides.
| Topic | What Subpart E says |
|---|---|
| Reliance on other screening | A state may rely on Medicare contractors or other states’ Medicaid or CHIP screening (455.410(c)) |
| Fee already paid elsewhere | The collection duty excludes a provider enrolled in Medicare or another State’s title XIX or XXI plan, or one that paid the fee to a Medicare contractor or another State (455.460(a)(2)) |
What does it cost?
Authority fees: section 455.460(a) says states must collect the applicable application fee “prior to executing a provider agreement from a prospective or re-enrolling provider” other than individual physicians or nonphysician practitioners and the exempt providers in the table. The text states no dollar amount. Verify current fees with CMS and each state Medicaid agency.
Consulting: IHS scopes each engagement after a free introductory call. Scope moves with the number of states, locations and owners and how current your records are.
Internal staff time: your enrollment lead, compliance lead and authorized official spend time on disclosures, signatures and state requests either way.
What is a Medicaid enrollment program not?
- It is not legal advice. IHS is a consulting firm, not a law firm, and counsel handles terminations, denials and appeals.
- It is not a statement of any one state’s rules. States differ in forms, cycles and fees.
- It is not a guarantee that a state will enroll or keep a provider enrolled.
- IHS does not submit packets or deal with a state Medicaid agency. Your authorized official does.
Frequently asked questions
How often must Medicaid providers revalidate?
Section 455.414 says the agency must revalidate all providers “at least every 5 years.” That is the outer limit, and a state may screen more strictly (section 455.452). IHS puts each date on one calendar.
Who has to be disclosed on a Medicaid enrollment?
Section 455.416(a) ties termination to any person with a 5 percent or greater direct or indirect ownership interest who did not submit timely and accurate information, section 455.416(d) adds agents and managing employees, and section 455.436(a) reaches them too. IHS drafts a worksheet for each.
What are the Medicaid screening risk levels?
Section 455.450 uses “limited,” “moderate,” and “high.” Moderate adds on-site visits to the limited checks, and high adds a criminal background check and fingerprints. The highest applicable level governs.
When does a provider move to high risk?
Under section 455.450(e) the state must raise a provider to high when it imposes a payment suspension based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years. A lifted moratorium can also do it, on that section’s conditions.
What happens if an owner does not submit fingerprints?
The agency “Must terminate or deny enrollment” if the provider or a 5 percent owner misses the 30 days, unless the state determines that termination or denial is not in the best interests of the Medicaid program and documents that in writing (section 455.416(e)). The exception is the state’s call.
Does a new practice location need its own screening?
Yes. Section 455.450 has the agency screen initial applications, “including applications for a new practice location.” IHS adds each new location to the inventory and disclosure worksheet.
What does deactivation do under the federal Medicaid rule?
Section 455.420 says that after deactivation for any reason, before reactivation, the agency “must re-screen the provider and require payment of associated provider application fees.” IHS builds a re-screening packet into the plan.
Do I enroll in each state separately?
Plan on it. Each State Medicaid agency screens its own enrolled providers (section 455.410(a)). A state “may rely” on Medicare or other states’ screening (section 455.410(c)) but is not required to.
What does IHS draft, and what do we supply?
IHS drafts the inventory, disclosure worksheets, packets, response plans and calendar. You supply state forms, license records, owner and location lists and signatures, and your authorized official submits. IHS scopes each engagement after a free introductory call.