Medicaid Provider Enrollment and Credentialing: A State-by-State Playbook for 2026

If you have enrolled a provider with Medicare, you know the rhythm: one application, one system, one set of rules. Medicaid does not work that way, and the single biggest source of wasted weeks in Medicaid enrollment is assuming it does.

Medicaid is a federal-state partnership. Congress and CMS set a floor. Each state builds on it with its own portal, provider type list, document requirements, revalidation process, and in most states its own managed care organizations that credential and contract separately from the state. A physician practicing in three states runs three enrollments.

This guide covers what is the same everywhere, what changes at the state line, and how to sequence the work so the first claim pays. It is written for the people who do this work: practice managers, billers, credentialing coordinators and providers who want the parts that actually cause rework.

Medicaid is 50-plus programs, not one payer

There is no national Medicaid provider file and no national application. When someone tells you "you are enrolled with Medicaid," the only correct follow-up is "which state, and fee-for-service or a managed care plan?"

CMS says this plainly in its own guidance to providers: "these programs are administered by individual states. You'll need to enroll in each state for which you would like to provide services to that state's eligible residents" (Medicaid Provider Enrollment Compendium, CMS). Each state Medicaid agency, abbreviated SMA in federal documents, runs its own enrollment operation.

Three structural facts drive everything else here.

First, most Medicaid beneficiaries are covered through managed care. Enrolling with the state is necessary but usually not sufficient. You also have to be credentialed and contracted with the managed care organizations that cover your patients.

Second, since January 1, 2018, providers who only see managed care patients still have to enroll with the state Medicaid agency. That came from section 5005(b)(2) of the 21st Century Cures Act, implemented at 42 CFR 438.602(b). It still catches groups by surprise.

Third, the federal screening rules at 42 CFR part 455 subpart E apply in every state. Risk levels, database checks, site visits, fingerprinting and revalidation are not state preferences. States differ in how they implement them, not whether they apply.

What "state-specific" actually means

The left column is settled federal law everywhere. The right column is a state decision, and assuming you know the answer from another state is how applications get rejected.

The federal floor: what 42 CFR 455 subpart E requires everywhere

Subpart E is short, and reading it once is worth more than twenty state FAQ pages. Here is what it obligates your state to do to you.

Screening risk levels

Under 42 CFR 455.450, the state assigns every applicant a categorical risk level of limited, moderate or high. The assignment is made on initial applications, on applications for a new practice location, and on applications responding to a revalidation or re-enrollment request. If a provider could fit more than one level, the highest governs.

CMS's fact sheet gives the standard examples. Limited risk typically covers physicians and non-physician practitioners, hospitals, skilled nursing facilities, rural health clinics and end-stage renal disease facilities. Moderate risk covers ambulance suppliers, community mental health centers, comprehensive outpatient rehabilitation facilities, hospices, and currently enrolled home health agencies and DME suppliers. High risk covers newly enrolling home health agencies and DME suppliers, and any provider under a payment suspension ("Fact Sheet: Medicaid Provider Enrollment Requirements," CMS).

Two caveats. States may impose screening "in addition to or more stringent than" the federal minimum, and a normally limited-risk provider can be elevated because of program history. The fact sheet is explicit: "Providers should check with their SMA to determine their risk category."

So: enrolling a home health agency or DME supplier for the first time means budgeting for a site visit and fingerprinting every owner at 5 percent or more. Enrolling a physician into an existing group is almost certainly the limited lane, where the work is document hygiene rather than logistics.

Database checks

Under 42 CFR 455.436 the state must confirm identity and exclusion status against the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the HHS-OIG List of Excluded Individuals/Entities, and the exclusion records in the System for Award Management. These run on enrollment, on revalidation, and then "no less frequently than monthly" on an ongoing basis.

That last phrase is the one to internalize. Exclusion screening is not a one-time gate: a newly excluded owner, managing employee or rendering provider surfaces on a routine monthly sweep and can stop payment. Run your own monthly checks on the same population, and keep the evidence.

Site visits and fingerprints

For moderate and high risk providers, 42 CFR 455.432 requires pre-enrollment and post-enrollment site visits, and requires providers to permit unannounced inspections by CMS, the state and their agents. The purpose is narrow: confirm the application describes a real, operating location.

For high risk providers, 42 CFR 455.434 requires consent to a criminal background check including fingerprinting, and the scope reaches beyond the provider. It applies to "a person with a 5 percent or more direct or indirect ownership interest in the provider," and fingerprints must be submitted "within 30 days upon request from CMS or the State Medicaid agency."

Thirty days is short when the owner is an out-of-state investor or a retired founder who still holds equity. Identify everyone at 5 percent or more before you file.

Revalidation at least every five years

42 CFR 455.414 requires revalidation "at least every 5 years" for all provider types. The words "at least" carry weight: states may revalidate more often, and several do.

The application fee

States must collect an application fee to offset screening costs. Individual physicians and non-physician practitioners are not required to pay it, and neither are providers already enrolled in Medicare. Institutional providers, including hospitals, skilled nursing facilities, ambulance services and pharmacies, are, and one fee is due per enrollment or revalidation cycle ("Fact Sheet: Medicaid Provider Enrollment Requirements," CMS).

CMS adjusts the amount every calendar year using the consumer price index. For 2026 the federal application fee is $750, up from $730 in 2025, applicable beginning January 1, 2026 ("Federal Provider Enrollment Application Fee Increase for Year 2026," NC Medicaid). If the provider already paid the fee to Medicare or another state Medicaid program in the same cycle, say so on the application; states coordinate to avoid collecting it twice.

Under 42 CFR 455.470, CMS and states may also impose temporary enrollment moratoria on provider categories in specific geographies, in six-month periods extendable in six-month increments. If you are enrolling a home health agency, DME supplier or ambulance service, check for an active moratorium first.

Where the states diverge

Everything above is the floor. Here is where the work actually differs state to state.

Provider type eligibility. Not every discipline can enroll in every state's program. CMS acknowledges this directly: "To the extent a provider type is not eligible to enroll in a State's Medicaid Program, the SMA is not required to begin to enroll that provider type" (Medicaid Provider Enrollment Compendium). Confirm your provider type exists on the state's list before you build a packet.

Group versus individual structure. Some states enroll the individual and link them to a group NPI and service location. Others enroll the group first and add rendering providers underneath. Some require a separate record for every physical location. Getting this order wrong is a common cause of a rejected packet.

Medicare as a prerequisite. Some states require certain provider types to hold an active Medicare enrollment first, and many rely on Medicare screening rather than repeating it. Federal rules permit but do not require that reliance: the state "may, but is not required to, rely on provider screening performed by Medicare" (Medicaid Provider Enrollment Compendium). Verify this with your state Medicaid agency before assuming either way.

Out-of-state enrollment. Requirements vary. Pennsylvania, for example, requires out-of-state practitioners to be licensed and currently registered in their own state and to "provide documentation that they participate in that state's Medicaid program" ("PROMISe Provider Enrollment," Pennsylvania Department of Human Services).

Credentialing model. In most states each MCO credentials separately. In a few, the state centralizes it so you do it once. That difference alone can move a timeline by months.

Three separate jobs: state enrollment, MCO credentialing, MCO contracting

People lose months treating these three as one task.

Job one: enrollment and screening with the state

Enrollment is a program integrity function. CMS defines screening as "a required element of the provider enrollment process effectuated via execution of a provider agreement between the state and the provider," used "to determine whether an individual is eligible to participate under the Medicaid state plan" (Medicaid Provider Enrollment Compendium).

There is no federally required application form. What is required is a provider agreement with the state, and CMS interprets the statutory reference to an enrollment application as that agreement. "Enrolled" means screening is complete and an agreement is executed.

Job two: credentialing by the managed care organization

Credentialing is a quality function and it belongs to the plan. Under 42 CFR 438.214 it is "the process conducted by the plan by which to verify whether the provider is qualified to perform or deliver services," including verification of education, training, liability record and practice history.

The two do not substitute for each other. A provider can clear every federal screening requirement, be fully enrolled with the state, and still be declined by a plan for failing that plan's criteria, for instance a board certification the plan requires. "This denial would not preclude the provider from enrollment with the FFS program, unless the SMA has a similar criteria for eligibility" (Medicaid Provider Enrollment Compendium).

Job three: the network contract

Even a fully enrolled, fully credentialed provider is out of network until a contract is signed and the provider is loaded into the plan's system with the right effective date, TIN, service locations and fee schedule. Networks can also be closed. Pennsylvania's Department of Human Services puts it about as bluntly as a state agency can: "Enrollment in state Medicaid does not guarantee enrollment in individual MCO Networks... some MCO provider networks may be closed due to network adequacy" ("PROMISe Provider Enrollment," Pennsylvania DHS).

The 120-day provisional window

There is one useful piece of flexibility. Managed care entities "may execute network provider agreements for up to 120 calendar days pending the completion of the screening required under 455 Subparts B & E." If the 120 days expire with no enrollment decision, or the state notifies the plan that the provider does not meet enrollment requirements, the plan must terminate the agreement immediately and notify affected enrollees (Medicaid Provider Enrollment Compendium; 42 CFR 438.602). Used well, this seats a provider while the state application is pending. It is not automatic: ask each plan whether it uses the window, and track the expiry date yourself.

CAQH and the plans

Many Medicaid MCOs pull credentialing data from CAQH rather than collecting a paper application. Where they do, the CAQH profile is the highest-leverage artifact in the project: attested within the plan's window, with current malpractice coverage, a complete work history with no unexplained gaps, correct practice locations, and every expirable document in date.

A stale attestation is a silent failure: the plan does not always tell you it could not pull your file, and the application simply sits. Put attestation on a recurring calendar.

Centralized credentialing states

A few states have taken credentialing away from the plans entirely. Ohio is the clearest example: since October 1, 2022 the Provider Network Management module accepts Medicaid enrollments and performs centralized credentialing, so providers "need apply only once" instead of completing "six unique credentialing processes" ("Centralized Credentialing Frequently Asked Questions," Ohio Department of Medicaid). Georgia similarly streamlined enrollment with "a single application for Medicaid and various care management organization participation" (Georgia Department of Community Health).

In a centralized state, do not build a plan-by-plan workflow. Everywhere else, do not assume a neighboring state's centralized model applies.

ORP enrollment, NPI and taxonomy alignment

Ordering, referring and prescribing

42 CFR 455.410(b) requires the state to enroll "all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan" as participating providers. 42 CFR 455.440 then requires claims for ordered or referred items to carry the NPI of the professional who ordered or referred.

Together those produce the denial that blindsides labs, imaging centers, DME suppliers, home health agencies and pharmacies: your enrollment is fine, your claim is clean, and it still denies because the ordering physician is not enrolled in that state's program.

Several details are worth knowing:

• ORP enrollment does not turn anyone into a billing provider. CMS is explicit that "enrollment in Medicaid does not require an ordering or referring physician or other professional to become a rendering provider." Many states offer a limited ORP-only or non-billing enrollment; New York runs an OPRA track, for ordering, prescribing, referring and attending professionals, through eMedNY.
• A provider already enrolled as a participating provider does not need a second application to order or refer.
• The requirement applies equally to in-state and out-of-state ORPs, and without regard to employer, including VA and IHS physicians.
• Hospitalists and contracted emergency physicians are a frequent gap. Services, items or prescriptions they order "are ineligible for payment unless the hospitalist/physician is enrolled in Medicaid," subject to narrow exceptions.
• Substituting someone else's NPI is not a fix. A hospital claim carrying the attending's NPI in the ordering/referring field, where the actual orderer was a provider type eligible to enroll, "is not compliant under 455.440 and must be denied."

There is a limited out-of-state exception. Claims based on an out-of-state ORP's order can qualify for federal financial participation where the item or service is furnished by an institutional provider, by an individual practitioner in an institutional setting, or by a pharmacy on such a practitioner's prescription, all at an out-of-state location, and the ORP's NPI is on the claim, and the ORP is enrolled and approved in Medicare or another state's Medicaid plan. If your volume depends on that exception, read the criteria in full.

The requirement also reaches managed care. Under 438.602(b)(1) it "applies to all network providers and includes network providers who order or refer to other providers," though not to out-of-network providers.

NPI and taxonomy

A taxonomy code is "a unique 10-character code that designates your classification and specialization," maintained by the National Uniform Claim Committee. Providers self-select, and "you may select more than one code or code description when applying for an NPI, but you must indicate one of them as the primary code" ("Find Your Taxonomy Code," CMS).

Self-selection is why taxonomy causes so many rejections. Nobody checks your choice when you make it in NPPES, but three systems later it has to agree with everything else:

• The NPPES taxonomy must be consistent with the provider type and specialty claimed on the state application.
• It must be a code the state recognizes for that provider type. A legitimate NUCC code the state does not map will fail.
• The taxonomy billed on the claim must match the enrollment record, at both individual and group level where the state requires both.
• A Type 1 NPI belongs to the individual and a Type 2 to the organization. Enrolling a solo practice under a Type 1 when the state expects a Type 2, or the reverse, causes rejections that look like coding problems and are not.

Before you file, read the NPPES record as though you were the state analyst. Legal name, other name, mailing address, practice location, authorized official, taxonomy, license number and license state all have to be current and consistent. NPPES is the cheapest thing to fix and the most expensive thing to leave wrong.

The same discipline applies to the TIN, which must match the legal entity name exactly as the IRS has it on the CP 575 or 147C letter, character for character. "Main Street Family Medicine LLC" and "Main Street Family Medicine, LLC" are not the same string to an automated matching routine. This is the most common avoidable rejection in Medicaid enrollment, and starting from the IRS letter rather than a letterhead prevents it entirely.

Disclosures, documents, and what to gather before you start

Ownership and control disclosures

42 CFR 455.104 requires disclosure of the name and address of every person with an ownership or control interest, their date of birth and Social Security number, the tax identification number for corporate owners, whether any owner is related to another as spouse, parent, child or sibling, other entities in which owners hold an interest, and the same identifying detail for every managing employee.

A person with an ownership interest means an individual or entity with direct or indirect ownership totaling 5 percent or more. Direct ownership is equity in the capital, stock or profits of the entity. Indirect ownership is an interest in another entity that in turn owns part of the disclosing entity.

Disclosure is required at four points: on application, on signing the provider agreement, when the state requests it on revalidation, and within 35 days after any change in ownership ("Fact Sheet: Medicaid Provider Enrollment Requirements," CMS).

Separately, within 35 days of a state request, providers must disclose ownership interests in subcontractors with whom they have had business transactions totaling more than $25,000 in the previous 12 months, and any significant business transactions with a wholly owned supplier or subcontractor in the previous five years. Under 455.106, they must also disclose criminal convictions related to Medicare, Medicaid or CHIP for owners, agents and managing employees.

Getting this wrong is expensive: federal financial participation "is not available in payments made to a disclosing entity that fails to disclose ownership or control information." Network providers are subject to the same rules, because 438.602(b) requires them to be screened under part 455 subparts B and E.

The document set

Most Medicaid applications draw from the same pool. Build the packet once, keep it current, reuse it.

Individual provider:

• Current, unrestricted license for the enrolling state, plus any other state where licensed
• DEA registration with the correct state address, plus any state controlled substance registration
• Board certification where held, and medical school, residency and fellowship documentation
• Type 1 NPI confirmation with correct taxonomy
• Social Security number, date of birth, government-issued photo ID
• Work history with month and year, gaps explained in writing, and a CV that matches it
• Malpractice certificate showing limits and dates, and ECFMG certificate where applicable

Group or facility:

• IRS CP 575 or 147C confirming legal name and TIN, and a matching W-9
• Type 2 NPI confirmation with correct taxonomy
• State business registration or articles of organization
• Ownership and control disclosure covering everyone at 5 percent or more, direct or indirect
• Managing employee list with dates of birth and Social Security numbers
• Voided check or bank letter for EFT setup
• CLIA certificate where lab services are performed, plus facility licenses, accreditation and certifications
• Service location addresses, distinguishing physical, mailing and pay-to

Step by step: running a Medicaid enrollment

This is the sequence that produces the fewest surprises.

1. Decide what you are actually enrolling for. Fee-for-service only, managed care only, or both. If any of your patients are in managed care, you need state enrollment plus plan credentialing plus a plan contract. If a provider will only order, refer or prescribe, ask whether the state has an ORP-only path.

2. Confirm the provider type is eligible in that state, and check for an active moratorium. Moratoria apply mainly to home health, DME and ambulance, and confirming costs nothing.

3. Clean up NPPES first. Verify Type 1 and Type 2 records, taxonomy, addresses, license data and authorized official. Fix anything wrong and let it propagate before you file.

4. Pull the IRS letter and reconcile the legal name and TIN. Make the application, the W-9 and the EFT form all use the exact IRS string.

5. Identify your risk level and prepare for it. Limited means documents. Moderate means expect a site visit, so make sure the location is staffed, signed and open. High means fingerprinting for everyone at 5 percent or more, on a 30-day clock once requested.

6. Assemble the ownership and disclosure package before you open the portal: every owner at 5 percent or more, direct and indirect, with dates of birth and Social Security numbers, every managing employee, every related-party relationship, and conviction disclosures.

7. Register for portal access. Most state systems require identity proofing for the user account, separate from the application, and that alone can take days. Illinois requires an account and identity proofing in IMPACT before any application can be started.

8. Submit the application and pay the fee if you owe one. Individual physicians and practitioners generally do not. Institutional providers generally do. Medicare-enrolled providers are generally exempt.

9. Track by reference number and answer requests fast. Most states set a short clock on additional information requests, and missing it usually means the application is closed rather than paused.

10. Get the approval letter and read the effective date, not the approval date. That is the date from which you may bill. Enter it in the billing system before releasing claims.

11. Start plan credentialing and contracting. Unless your state centralizes credentialing, this is a separate application to each MCO, usually through CAQH plus a contract request. Get each plan's effective date in writing and confirm the provider is loaded before releasing claims.

12. Set your maintenance calendar on day one, not at the first denial: revalidation, license expirations, DEA, malpractice, CAQH attestation and monthly exclusion checks.

State portals: eight examples, and why you still have to check your own

The portals below show how differently states package the same federal requirements. They are not a lookup table for your enrollment. Every state has its own system, provider type list and process, and portal names and requirements change. Use your own state Medicaid agency's official page.

Four patterns worth stealing regardless of state. Use the readiness tool if there is one: Florida's returns your provider type, enrollment category, required documents and risk-based screening level before you start. Expect a separate identity-proofing step, since Illinois and Ohio both gate the portal behind a verified user account. Read the revalidation notice rules, because New York's enrollment page instructs that "Revalidations should not be attempted until notified individually to do so." And watch the response clock inside the portal: in Ohio's PNM a Begin Revalidation link appears during the 120-day window before the agreement end date, and once started there is a short window, reported as 10 days, to complete and submit.

Timelines, effective dates and retroactive enrollment

What to plan for

Nobody can promise a Medicaid approval date, and anyone who does is guessing. What you can do is plan around realistic ranges and the factors that move them.

Treat these as planning ranges, not commitments. Current processing times are available from each state Medicaid agency and each plan, and they move with volume. Confirm them before you promise a provider a start date. The compounding is what people underestimate: because state approval, plan credentialing and plan loading are sequential in most states, a limited-risk physician joining a group in a managed care state is realistically a multi-month project end to end.

Effective dates

The approval date and the effective date are different, and only one matters for billing. Read the approval letter, find the date from which claims may be submitted, and load that into your practice management system before releasing held claims.

For MCO contracts, get the effective date in writing, then verify the provider actually appears in the plan's system under the correct TIN and location. A contract effective date with no system load produces denials that look like eligibility problems and are really loading problems.

Retroactive enrollment

Some states allow a retroactive billing date. CMS calls this backdating and treats it as a risk-managed exception rather than a routine courtesy: "The practice of 'backdating' enrollment involves approving an enrollment with a retroactive billing date. This practice allows a provider, once enrolled, to submit claims for services dated prior to the date upon which the SMA approved the enrollment" (Medicaid Provider Enrollment Compendium).

CMS's guidance to states is cautionary. Where a provider was subject to a site visit and the state nonetheless permits billing for earlier dates, "there is risk the provider was not present at the site on the date of service." CMS tells states to have a documented process for deciding when retroactive billing is appropriate, and warns that payment issued before screening and enrollment is an improper payment unless an exception applies. Factors a state may weigh include emergency access, pre-authorization, and whether the provider is enrolled in Medicare or another state's Medicaid program.

What that means for you:

• Retroactive billing exists in many states but is discretionary, bounded and never guaranteed, and the window is usually short and often keyed to the application receipt date.
• Ask about it explicitly, in writing, at the time of application. Do not discover it at appeal.
• Hold claims rather than submitting and hoping. A denied claim with a timely filing clock running is worse than a held claim with a documented hold reason.

What goes wrong: rejections before approval and denials after

Rejections before approval

Denials after enrollment

These are the patterns that show up on remittance advice after everything looked fine.

The provider was not eligible on the date of service. Almost always an effective date problem. Compare the date of service to the effective date on the approval letter, and to the plan's load date if the claim went to an MCO. If the service predates the effective date, check whether the state allows a retroactive adjustment. If the load date is the issue, that is a plan correction, not an appeal.

The claim is covered under a capitation or managed care arrangement. The patient was in an MCO and the claim went to fee-for-service, or to the wrong MCO. Verify eligibility and plan assignment on every date of service. Medicaid plan assignment changes more often than commercial coverage.

The ordering or referring provider is missing, invalid or not enrolled. The 455.440 denial. Confirm the ORP NPI is on the claim, belongs to the person who actually ordered, and belongs to someone enrolled in that state's program. Substituting the attending's NPI will deny again.

Taxonomy or rendering provider not recognized. The billed taxonomy does not match the enrollment record, or the rendering provider is not linked to the billing group in the state's file. Fix the enrollment record, then correct and resubmit. Fixing only the claim guarantees a repeat.

Service location not on file. A new location was opened and never added. Many states require at minimum a location addition, and some treat it as a new application subject to fresh screening.

Payment stopped with no claim-level reason, or everything denies after a quiet period. Check exclusion status first, since federal database checks run at least monthly and a newly excluded owner, managing employee or rendering provider can stop payment. Then check revalidation: a missed revalidation deactivates the provider, and in many states claims for dates after deactivation will not pay until the record is reinstated, sometimes with an unrecoverable gap.

A workable triage order for any Medicaid denial: member plan and eligibility on the date of service, then enrollment status and effective date, then the ORP NPI, then taxonomy and rendering-to-group linkage, then the claim itself. Most teams start at the claim and work backward, which is why the same denial recurs.

Fast Track Credentialing is an independent credentialing service and is not affiliated with or endorsed by any state Medicaid agency or health plan.

Revalidation and ongoing maintenance

Revalidation

The federal rule is a floor, not a ceiling: revalidate at least every five years under 42 CFR 455.414. States may require it more often, and in centralized credentialing states the cycles stack. Ohio illustrates how two coexist. Provider agreements must be revalidated no later than five years from the effective date of the original or last revalidated agreement, while providers subject to centralized credentialing recredential on a three-year cycle, so revalidation runs every three years for credentialed providers and every five for non-credentialed providers ("Federal and State Requirements for Revalidation and Recredentialing," Ohio Department of Medicaid).

Revalidation is a full screening event, not a renewal checkbox. The state re-runs database checks, re-verifies licensure, re-collects ownership and control disclosures, and reapplies your risk level. At moderate or high risk, a site visit or fingerprinting can be part of it. And if the ownership structure changed since the last cycle, revalidation is where the undisclosed change surfaces.

Three habits prevent most revalidation failures:

• Keep the notification address current, and make it a monitored group mailbox rather than one person's inbox
• Check the portal message center on a schedule even when you expect nothing
• Calendar the due date from the approval letter the day it arrives, with reminders at 180, 120, 90 and 30 days

Missing the deadline usually means deactivation or termination. Reactivation can require a new application with fresh screening, and claims during the gap may be unrecoverable.

Ongoing maintenance

Medicaid enrollment is a living record. These changes almost always require a portal update, usually within a defined window:

• Change of ownership, or any change in an interest at 5 percent or more, within 35 days
• New or departing managing employee
• New or closed service location, or a change of address
• Change of legal name, doing-business-as name, TIN, or EFT bank account
• License, DEA, malpractice, certification or accreditation renewals
• A provider leaving the group, so the link is end-dated rather than left open
• Adverse actions: license discipline, exclusion, sanction, malpractice settlement

And a standing rhythm:

• Monthly: exclusion screening for every provider, owner and managing employee, and a roster reconciliation against the state file and each plan's directory
• Quarterly: confirm CAQH attestation is current, and pull an upcoming-expirations report across licenses, DEA, malpractice and certifications
• Annually: review ownership and disclosure records against the current cap table and org chart

Directory accuracy deserves its own line. A provider who is enrolled and contracted but listed wrong in the plan directory still loses referrals. Check your own listing the way a patient would.

The Medicaid enrollment checklist

Before you submit:

• Provider type confirmed eligible in this state, and no active moratorium
• NPPES Type 1 and Type 2 records verified: name, address, taxonomy, license, authorized official
• Taxonomy confirmed against the state's recognized provider types
• Legal name and TIN copied exactly from the IRS CP 575 or 147C, and the W-9 matches
• Risk level identified and prepared for
• All owners at 5 percent or more identified, direct and indirect, plus managing employees, related-party relationships and conviction disclosures
• Licenses, DEA, malpractice and certifications current with no expiration inside the review window
• Work history complete with month and year, gaps explained in writing
• Service locations listed accurately, physical, mailing and pay-to distinguished
• Fee liability determined and prior payment documented if applicable
• Portal account created, identity proofing passed, and a named owner monitoring the message center

After state approval:

• Approval letter filed, effective date in the billing system, retroactive window confirmed in writing if the state allows one
• Held claims released only after the effective date is confirmed
• CAQH profile complete, attested and documents current
• Credentialing submitted to each MCO, unless the state centralizes it, and a contract requested
• Contract effective date and fee schedule in writing, and the provider verified as loaded under the correct TIN and location
• Test claims adjudicated before releasing full volume
• Revalidation calendared, monthly exclusion screening scheduled, directory listings checked

If you want this run end to end rather than in-house, our credentialing service covers state enrollment, MCO credentialing and contracting as one tracked project, with pricing and ordering listed openly.

Frequently asked questions

Do I have to enroll with the state Medicaid agency if I only see managed care patients?

Yes, in every state. Section 5005(b)(2) of the 21st Century Cures Act, implemented at 42 CFR 438.602(b), requires states to screen, enroll and periodically revalidate all network providers of MCOs, PIHPs and PAHPs under part 455 subparts B and E, effective January 1, 2018. It does not obligate you to see fee-for-service patients, and states may use a separate network-only provider agreement.

Does state Medicaid enrollment mean I am in network with the Medicaid plans?

No. They are separate steps with separate criteria. You can be fully screened and enrolled by the state and still be declined by a plan for failing that plan's credentialing criteria, and you can be credentialed and still lack a signed contract. Networks can also be closed.

How often do I have to revalidate?

At least every five years under 42 CFR 455.414. States may require it more often, and in centralized credentialing states a shorter cycle can run alongside the five-year agreement cycle. Ohio applies three-year recredentialing for credentialed providers while the agreement runs on five. Confirm your cycle with your state Medicaid agency.

Will I be fingerprinted?

Only at the high categorical risk level. Under 42 CFR 455.434, high-risk screening requires a fingerprint-based criminal background check of the provider and, for institutional providers, of every person with a 5 percent or more direct or indirect ownership interest, submitted within 30 days of the request.

Can I bill for services provided before my enrollment was approved?

Sometimes, depending on the state. CMS calls this backdating and treats it as a discretionary state decision rather than an entitlement, noting that payment issued before screening and enrollment is an improper payment unless an exception applies. Where available the window is usually narrow and often keyed to the application receipt date. Ask in writing at the time of application, and hold claims rather than submitting and hoping.

Do ordering and referring physicians have to enroll even if they never bill Medicaid?

Yes. 42 CFR 455.410(b) requires the state to enroll all ordering or referring physicians and other professionals, and 455.440 requires the ordering professional's NPI on the claim. Enrollment for this purpose does not make someone a rendering provider, and many states offer an ORP-only path; New York's OPRA track is one example. Hospitalists and contracted emergency physicians are the most commonly missed group.

What is the Medicaid application fee in 2026, and do I have to pay it?

The federal fee for calendar year 2026 is $750, up from $730 in 2025, for applications on or after January 1, 2026 ("Federal Provider Enrollment Application Fee Increase for Year 2026," NC Medicaid). Individual physicians and non-physician practitioners are generally exempt, as are providers already enrolled in Medicare. Institutional providers generally owe it, and only one fee is due per cycle.

My claims were paying and then stopped. Where do I look first?

Work backward from the payer, not the claim. Check the member's plan assignment and eligibility on the date of service, because Medicaid plan assignment changes frequently. Then enrollment status and effective date, since database checks run at least monthly and a missed revalidation or newly excluded owner can stop payment with no claim-level reason. Then the ORP NPI, then taxonomy and the rendering-to-group link. Only then the claim.

Do I need a separate enrollment for each practice location?

Often, yes. 42 CFR 455.450 requires screening for applications covering a new practice location, and many states require each physical location to appear on the enrollment record or be enrolled separately. A new location can therefore trigger fresh screening, including a site visit at moderate and high risk. Confirm the rule in your state before you open the doors, and if you want a second pair of eyes on the structure, get in touch.

Sources and verification

Every citation, portal name and fee here was verified against an official source on the date shown. Regulations change and portals are renamed. Verify anything you rely on against your own state Medicaid agency's current guidance.

Pages opened and reviewed directly:

• 42 CFR Part 455 Subpart E, Provider Screening and Enrollment, govinfo.gov. Checked 2026-09-13.
• 42 CFR 455.410, Enrollment and screening of providers, Legal Information Institute. Checked 2026-09-13. https://www.law.cornell.edu/cfr/text/42/455.410
• 42 CFR 455.434, Criminal background checks, Legal Information Institute. Checked 2026-09-13. https://www.law.cornell.edu/cfr/text/42/455.434
• 42 CFR 455.104, Disclosure by Medicaid providers and fiscal agents, Legal Information Institute. Checked 2026-09-13. https://www.law.cornell.edu/cfr/text/42/455.104
• 42 CFR 438.602, State responsibilities, Legal Information Institute. Checked 2026-09-13. https://www.law.cornell.edu/cfr/text/42/438.602
• Medicaid Provider Enrollment Compendium (MPEC), Centers for Medicare and Medicaid Services, last updated 12/29/2023. Checked 2026-09-13. https://www.medicaid.gov/sites/default/files/2023-12/mpec-12292023.pdf
• Fact Sheet: Medicaid Provider Enrollment Requirements, Centers for Medicare and Medicaid Services. Checked 2026-09-13. https://www.cms.gov/files/document/mpe-factsheet082616pdf
• Find Your Taxonomy Code, Centers for Medicare and Medicaid Services. Checked 2026-09-13. https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/health-care-taxonomy
• Federal Provider Enrollment Application Fee Increase for Year 2026, NC Medicaid, North Carolina Department of Health and Human Services. Checked 2026-09-13. https://medicaid.ncdhhs.gov/blog/2025/12/08/federal-provider-enrollment-application-fee-increase-year-2026
• Provider Enrollment, Texas Medicaid and Healthcare Partnership (PEMS). Checked 2026-09-13. https://www.tmhp.com/topics/provider-enrollment
• Provider Enrollment, eMedNY, New York State Department of Health. Checked 2026-09-13. https://www.emedny.org/info/ProviderEnrollment/index.aspx
• PROMISe Provider Enrollment, Pennsylvania Department of Human Services. Checked 2026-09-13. https://www.pa.gov/agencies/dhs/resources/for-providers/promise/promise-provider-enrollment
• Centralized Credentialing Frequently Asked Questions, Ohio Department of Medicaid. Checked 2026-09-13. https://dam.assets.ohio.gov/image/upload/managedcare.medicaid.ohio.gov/PNM/Centralized-Credentialing-FAQ.pdf

Portal names and program details confirmed through official state domains, where the agency page could not be retrieved in full at the time of writing:

• Provider Application and Validation for Enrollment (PAVE), California Department of Health Care Services. Checked 2026-09-13. https://www.dhcs.ca.gov/provgovpart/Pages/PAVE.aspx
• Provider Enrollment, Florida Agency for Health Care Administration, and the Florida Medicaid Web Portal (FLMMIS). Checked 2026-09-13. https://ahca.myflorida.com/provider/enroll.html
• IMPACT, Illinois Department of Healthcare and Family Services. Checked 2026-09-13. https://hfs.illinois.gov/impact.html
• Georgia Medicaid Management Information System (GAMMIS), Georgia Department of Community Health. Checked 2026-09-13. https://www.mmis.georgia.gov/portal/
• Federal and State Requirements for Revalidation and Recredentialing, Ohio Department of Medicaid. Checked 2026-09-13. https://medicaid.ohio.gov/resources-for-providers/enrollment-and-support/frrr/federal-requirement-for-revalidation-reenrollment

Where this article could not confirm a point on an official page, it says so rather than guessing. Anything described as typical or a planning range is exactly that, not a promise about your state, provider type or timeline.