CMS Tightened Provider Screening in 2026. Is Your Enrollment Ready?

CMS did not hand provider screening a new rulebook in 2026. It tightened enforcement of the rules already on the books: fingerprint-based background checks reaching further into ownership structures, off-cycle revalidations CMS can order on its own schedule, monitoring expectations trending toward monthly, faster consequences for missed reporting deadlines, and a nationwide off-cycle Medicaid revalidation sweep ordered in April.

Before I built software solutions for credentialing teams, I worked for more than a decade in healthcare administration. I handled prior authorizations. I wrote the denial appeals. I know exactly what it feels like to learn that a provider's billing privileges lapsed only after the claims started bouncing, and to lose a week untangling a mess that could have been prevented with a proper reminder system.

I've stepped on these landmines before, and I'm going to show you where they are: what actually changed this year, what only feels new, and what both mean for your day-to-day process.

What changed

First, something to get straight, because it changes how you respond: 2026 did not hand enrollment teams one big new rulebook with a January 1 effective date. Most of the standards below have been tightening piece by piece for years. What changed this year is the enforcement posture. CMS is checking more, revalidating more, and moving faster when something is out of line. That distinction matters. "The rules changed" means you have something new to learn. "The enforcement changed" means the gaps you've been getting away with stopped being safe.

Fingerprint-based background checks reach further than a lot of teams realize. CMS has been moving more provider categories into its high-risk screening tier (skilled nursing facilities joined in 2023, along with expanded high-risk screening at changes of ownership). For high-risk providers, fingerprinting extends to anyone with a 5 percent or greater ownership stake, not only the provider on the application. If a change of ownership is anywhere in your plans, build these checks into the timeline. They are a known source of enrollment delays.

The revalidation clock got shorter, in practice, if not on paper. The standard cycles haven't changed: five years for most providers and suppliers, three for DMEPOS. What changed is how freely CMS uses its authority to revalidate off-cycle, on its own schedule. It ordered every skilled nursing facility in the country into an off-cycle revalidation to collect new ownership disclosures, moved the deadline repeatedly through 2025, then paused the sweep indefinitely that December. That reversal is proof the schedule is CMS's to set and to change. The Medicaid initiative below goes further still. If your tracking assumes the next revalidation is years away because the last one just closed, that assumption is no longer safe, and nobody's going to call to remind you.

Point-in-time checks are giving way to ongoing monitoring. Checking the OIG exclusion list and SAM.gov isn't a new expectation either: OIG has recommended routine screening for years. What's different is that payers, states, and CMS increasingly treat monthly as the floor and expect documentation to prove it, which can come as a shock for teams who used to run quarterly, or sporadically when time allowed.

The reporting windows are not new, but their enforcement is. Ownership changes, adverse actions, and new practice locations still have to be reported within 30 days, and other changes within 90. What did change is what happens when you miss. CMS is far quicker to revoke or deactivate billing privileges than it used to be.

And consequences don't stay in their lane. Federal rules have long required state Medicaid programs to terminate providers that Medicare terminated for cause. That requirement dates to the Affordable Care Act. For years, the linkage between the two programs was inconsistent in practice. The data sharing has caught up. One miss now means two non-billable programs.

The revalidation sweep nobody scheduled

On top of the standing changes, CMS kicked off a nationwide push in April. Under the initiative announced by Administrator Dr. Mehmet Oz, all states were required to submit two-year plans to revalidate their Medicaid providers, with a hard focus on off-cycle revalidation of anyone flagged as high risk. CMS also expects states to treat any provider without an NPI as high-risk by default. Those plans are now in (strategies were due in early June), and Minnesota's early numbers show what execution looks like: of roughly 5,600 providers ordered through the state's first high-risk sweep, more than 3,400 were disenrolled (most often for incomplete applications rather than fraud), though by mid-June the state had resumed payments for roughly 2,100 of them while their appeals play out.

Translation from someone who has been on the receiving end of these notices: expect more revalidation, sooner, and on a schedule you didn't pick. The comfortable five-year rhythm isn't something to lean on anymore.

Why this all lands on enrollment

Every one of these changes assumes the same thing about your operation. That your data is current, your dates are tracked, and your monitoring is continuous. Miss a revalidation deadline and CMS can deactivate billing privileges, with any services you deliver during that dead window not covered. None of this is theoretical. It's payroll you already ran against revenue that you'll never collect. And it's almost always preventable.

I'll be blunt about one more thing. No regulation names spreadsheets, but the bar a reviewer actually applies is this: "show me the monthly checks, with dates and results, for every provider on the roster." That is a bar spreadsheet-and-memory tracking fails in practice. If your documentation can't show when a check ran and what it found, then as far as a reviewer is concerned, it didn't happen.

What good looks like now

Here's the operational version, the way I'd set it up if I were running a credentialing desk in 2026.

Start with the dates. Every revalidation and expiration should be treated as real data with real lead-time alerts, not a sticky note that can get lost or a cell in a spreadsheet that can get deleted. Monitor monthly and document the results for license status, OIG, and SAM, instead of waiting for recredentialing to come back around. NPI and enrollment records stay accurate and reconciled against the source, because that's exactly what CMS is now checking. This keeps you audit-ready as a habit, so a review is a simple lookup and handoff, not hours of overtime spent scrambling.

Where Credential Network fits

What I love most about my job is the time spent on calls with credentialing specialists and enrollment leads figuring out how to solve their current pain points and adapt to changes exactly like these. We can't anticipate every curveball, but we're always looking ahead to make sure we're building tools that keep up with you and where this industry is headed. Credential Network addresses credentialing and payer enrollment as connected workflows on one platform. It tracks revalidation and expiration dates and surfaces them long before they become emergencies. It monitors continuously instead of at random, keeping a complete, timestamped record so an audit request doesn't turn your week upside down. We built this for teams who carry the weight of all these ever-changing regulations without an enterprise-sized staff behind them.

The thread running through all of it is the same. Enrollment isn't something you check off as finished. It's a process you maintain, continuously, and now on a shorter clock than you're used to. Get ahead of it now and you'll spend a lot less of this year reacting to notices you could have seen coming. I've lived on the reacting side. Ahead is better.

Danielle Jewhurst is Product Manager at Credential Network. Before moving into product, she spent more than a decade in healthcare administration, from health information management to billing, prior authorizations, and denials.

References

• CMS/Dr. Oz nationwide Medicaid provider revalidation initiative (April 2026): Nixon Peabody; National Law Review; Georgetown Center for Children and Families
• State strategies submitted and early Minnesota results (July 2026): Georgetown Center for Children and Families
• High-risk screening categories and fingerprint checks for 5%+ owners (SNFs moved to high-risk, and CHOW screening expanded, effective January 1, 2023): Maynard Nexsen; 42 CFR 424.518
• Standard revalidation cycles (5-year; 3-year DMEPOS) and off-cycle revalidation authority: CMS Revalidations; 42 CFR 424.515
• Nationwide SNF off-cycle revalidation (2024–25) and its indefinite pause (December 2025): Holland & Knight; Center for Medicare Advocacy
• OIG guidance recommending routine exclusion screening: OIG Exclusions Program
• Medicaid termination required when Medicare terminates for cause: 42 CFR 455.416
• Reporting timelines (30/90 days) under 42 CFR 424.516: eCFR