CMS Pushes Off-Cycle Medicaid Revalidation for High-Risk Providers
CMS told states to revalidate high-risk Medicaid providers off-cycle. What it asked for, how some states are doing it, and who's affected.
What CMS asked states to do
CMS doesn't want to wait five years to revalidate high-risk Medicaid providers. Off-cycle Medicaid revalidation means the state makes you revalidate before your regular five-year date comes up. Federal rules only require states to revalidate every five years under 42 CFR 455.414, the same interval Medicare uses for its own revalidation cycle, so CMS is pushing states to move high-risk providers to the front of the line. On April 23, 2026, CMS Administrator Mehmet Oz wrote to every state Medicaid director asking for a plan, within 10 days, for the "swift revalidation of high-risk providers," and a full two-year revalidation strategy within 30 days. The letter pointed states to the high-risk category in 42 CFR 455.450 and suggested they start with high-risk providers who hadn't been screened in the past 12 months.
The letter to governors went further. CMS said it expects states to include any provider without a National Provider Identifier in their high-risk definition, and that failing to act "will be considered as we evaluate the likelihood of fraud in each state moving forward." Texas says CMS wants every state finished by June 5, 2028. It fits with other 2026 program-integrity actions, including Medicaid payment suspensions in Ohio, New York and Minnesota and CMS's new authority to exclude providers.
How states are running off-cycle revalidation
Every state wrote its own plan over the summer, and the notices are now going out. These five have published enough detail to compare as of October 29.
| State | Who goes first | Notice and deadline | If you miss it |
|---|---|---|---|
| Texas | Providers the state selects; types not listed | Notices start Oct. 31 through PEMS, mail and email. You can start up to 180 days before your due date. No extensions. | Disenrolled unless PEMS shows "Closed-Enrolled" by the due date, and you have to reenroll |
| Louisiana | DME, mental health rehabilitation, personal care services and personal care attendants | Phased since June 2026. Gainwell sends an invitation with your due date. | Deactivated, with no payment from the due date until you finish |
| Missouri | Phase I: adult day care, DME, autism centers and providers without an NPI (deadline was Oct. 1). Phase II: home health, private duty nursing, ABA, hospice and substance use | Phase II is due March 2, 2027. Letters go by email to your eMOMED address at 120, 90, 60 and 30 days. | Administrative action, up to termination |
| New York | Phase 1: high-risk, DME and anyone not revalidated since the COVID emergency. Phase 2: ABA, HCBS waiver and home care agencies. Phase 3: providers without an NPI | Phase 1 began in July, Phase 2 this winter, Phase 3 early 2027. You get 123 days from the letter. | Terminated. Providers without an NPI can't complete it and will be terminated |
| California | Phase 1: DME, Drug Medi-Cal, clinical labs and transportation. Phase 2 adds pharmacies, home health, hospice, SNFs and providers without an NPI | Phase 1 runs through December, Phase 2 from January 2027 to June 2028. 35 days to respond, 70 to submit. | Automatic termination if you don't respond |
Pennsylvania and Wyoming have filed plans but haven't published deadlines.
Which Medicaid providers states call high-risk
The federal high-risk triggers in 455.450 are narrow, but states are adding their own provider types, and the same ones keep showing up: DME, personal care and attendant services, adult day care, ABA, home health, hospice, private duty nursing, clinical labs, transportation and anyone billing without an NPI. Providers without an NPI are in the hardest spot. New York says they won't be able to complete revalidation at all and will be terminated.
Why the notice matters more than the calendar
Off-cycle means your revalidation calendar is no longer the thing to watch. The notice is, and it goes to whatever contact information the state has on file. Missouri sends its letters by email to the eMOMED address, and New York uses email and regular mail. If the notice goes to someone who left last year, nobody reads it until the deadline has passed.
The deadline is for approval. Submitting on time isn't enough. Texas only counts a revalidation as done when PEMS shows "Closed-Enrolled," and California gives itself up to 180 days to review. High-risk screening means fingerprint background checks for anyone with a 5% or greater ownership interest and a site visit, and you don't control how long either one takes.
A missed revalidation doesn't stay in fee-for-service, either. Under 42 CFR 438.602(b), a Medicaid managed care plan has to terminate a provider as soon as the state says that provider can't be enrolled, so if a state deactivates you, your MCO contracts go with it.
What to check now
If you manage any of the provider types above, assume a notice is coming and look up your state's phase schedule. Check the contact information and account administrator in every state portal now, while there's still time to fix it. Get ownership, managing employee and license documents together so you can submit the day your window opens, and keep checking until the state shows the revalidation approved.
Questions about off-cycle Medicaid revalidation
What is off-cycle Medicaid revalidation? A revalidation the state requires before your regular five-year date. CMS asked every state in April to start with high-risk providers.
Which providers are considered high-risk? The federal list in 42 CFR 455.450 is narrow, but states are adding DME, personal care, adult day care, ABA, home health, hospice, private duty nursing, clinical labs, transportation and providers without an NPI.
What happens if you miss the deadline? It depends on the state. Texas disenrolls you, Louisiana stops payment from the due date, New York terminates, and California terminates if you don't respond. Managed care plans have to drop you once the state does.
Is submitting on time enough? No. Texas doesn't count it until PEMS shows Closed-Enrolled, and the fingerprint checks and site visits take as long as the state takes.
Discuss this post on LinkedIn
Questions, or a different read? Join the conversation where Tony posted it.
About the author
Tony Kuka · Founder, Ziurta
Tony is the founder of Ziurta, a provider enrollment platform for medical practices, health systems, RCM firms, and credentialing companies. He has 30 years in healthcare administration, including 20 building outsourced revenue cycle companies, and founded and sold Medical Business Office and National Credentialing Solutions. He is based in Chattanooga, Tennessee.