Ask the question in the title out loud at your next staff meeting. Watch what happens.

Usually one of two things. Either someone answers immediately, in which case you are in better shape than most practices. Or there is a pause, and two people look at each other, and somebody says "I think the billing company does that."

The pause is the finding.

What CAQH re-attestation is

CAQH ProView holds the provider information that most commercial payers pull from when they credential and re-credential. Education, licenses, work history, malpractice coverage, practice locations.

Payers do not just read the data. They look at the date you last confirmed it was accurate. That confirmation is the attestation.

The 120-day rule

Providers are asked to re-attest roughly every 120 days, which is about three times a year, whether or not anything has changed. An unchanged profile still goes stale, because payers check the attestation date rather than the edit history.

Three details make this harder than it sounds:

  • There is no meaningful alarm. A reminder email arrives in a provider's inbox, where it competes with everything else a physician receives in a day.
  • There is no automatic grace period. The clock does not extend itself. When the window passes, the profile is out of date.
  • It is per provider, not per practice. Five providers means five clocks, running on five different dates.

You can re-attest early, at any point in the cycle, and doing so resets the clock from the new date. That is the whole trick, and almost nobody uses it.

What happens when it lapses

Nothing dramatic, which is the problem. No phone call, no red banner on your practice management system.

What happens is quieter. Payer access to the profile pauses. Applications that were in progress freeze where they sit. Re-credentialing cycles stall. And because one profile feeds many payers, a single lapse can stall several relationships at once.

You usually find out weeks later, through denials. By then you are working backwards through claims that have already aged.

Why it is nobody's job

This is not a competence problem. It is an ownership problem, and it has a very specific shape.

The provider assumes the office manager handles it. The office manager assumes the billing company handles it. The billing company handles enrollment submissions, which is a different task, and assumes the provider maintains their own profile because the login belongs to the provider.

Everyone is being reasonable. The task still falls through, because the one thing nobody did was write down whose job it is.

The other clocks running at the same time

CAQH is the one with the shortest cycle, so it is the one that catches people. It is not the only one.

  • State license expiry, and in some states a separate controlled substance registration
  • DEA registration
  • Board certification
  • Malpractice certificate of insurance, which renews on the practice's policy date, not the provider's
  • Medicare revalidation, which runs on its own cycle and has been landing in clusters
  • Each Medicare Advantage plan separately. MA plans credential independently of traditional Medicare, so a provider can be fully enrolled with CMS and quietly not participating with three MA plans at the same time

That last one surprises people more than any other item on the list.

Work out your own number

Revenue-cycle firms publish figures for what a credentialing lapse costs per day. The numbers vary widely and none of them are yours, so do not borrow one. Work out your own.

Take one provider's average daily collections. Multiply by the number of days a lapse would realistically go unnoticed at your practice, which for most small practices is somewhere between two and six weeks, because you find out through denials.

That figure is the cost of nobody owning a calendar entry. It is the same shape of problem as the evidence your cyber insurer asks for. The control is usually fine. The record of it is the part nobody keeps. It is usually large enough to end the conversation.

What to do this week

Build one table. A spreadsheet is fine.

One row per provider. Columns for CAQH attestation date, license expiry, DEA expiry, board certification, malpractice certificate expiry, Medicare revalidation date, and then a column for each payer including every Medicare Advantage plan separately.

Then fill it in. The filling in is where the value is, because the cells you cannot fill are the answer to the question in the title.

If a vendor outage is the version of this you have already lived through, the clearinghouse piece covers that one. Finally, put one name at the top of the page. Not a department. A person, with a backup named underneath. Then set a monthly reminder for that person to look at it.

Questions people ask

Does our billing company handle CAQH?

Some do, as an explicit service. Many handle payer enrollment submissions, which is related but not the same thing, and assume the provider maintains their own profile because the credentials belong to the provider. It is worth asking the question directly and getting the answer in writing, because the practice absorbs the cost of a lapse either way.

Doesn't CAQH send reminders?

Reminders go to the contact on the provider's profile, which is usually the provider. That is the same inbox receiving everything else. A reminder that arrives somewhere nobody is watching is not a control.

What if a provider is already expired?

Re-attest as soon as possible. The cycle restarts from the new attestation date. Then check whether anything was in progress when it lapsed, because applications that froze do not always resume on their own.

How often should someone review the whole list?

Monthly is reasonable, and it takes a few minutes once the table exists. The 120-day cycle means a quarterly review can let a deadline pass unnoticed between checks.

We are a two-provider practice. Is this overkill?

Two providers means two CAQH cycles, two licenses, two DEA registrations and two sets of payer relationships. The table is shorter, not unnecessary. Small practices feel a single lapse harder, because the revenue is less diversified.

Sources and notes

  • The 120-day re-attestation cycle, the absence of an automatic grace period, and the effect of an expired profile on payer access are consistently documented across credentialing and revenue-cycle practice guidance reviewed in September 2026. CAQH's own requirements are the authority, and you should confirm the current cycle and your own dates inside your ProView profile.
  • Medicare provider enrollment and revalidation, including revalidation due dates, are published by CMS. cms.gov
  • Cost-per-day figures for credentialing lapses are published by revenue-cycle vendors and vary considerably. This article deliberately does not repeat one, and instead shows how to calculate your own.

This article is general information about operating procedures and recordkeeping. It is not legal advice, and it is not a determination of what any payer or program requires of your organization.