> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Track licenses, revalidations, and expirables
> One tracking system for licenses, DEA, board certifications, malpractice, CAQH attestation, Medicare and Medicaid revalidation, and payer recredentialing.
An MSO-PC group tracks hundreds of dated obligations across entities, clinicians, and payers. A single lapse — a license, a CAQH attestation, a Medicare revalidation — stops revenue. This guide builds the tracking system.
## What has to be tracked
### Per clinician
| Item | Cadence | Lead time |
| --------------------------------------- | -------------------- | --------- |
| State professional license | 1–3 years, per state | 60 days |
| DEA registration | 3 years | 60 days |
| State controlled substance registration | Varies | 60 days |
| Board certification | Per board | 90 days |
| **CAQH attestation** | **\~120 days** | 14 days |
| Malpractice coverage | Annual | 60 days |
| CME | Per board | 90 days |
| BLS/ACLS where applicable | 2 years | 30 days |
| Immunizations / TB where required | Annual | 30 days |
### Per clinician per payer
| Item | Cadence | Lead time |
| ---------------------------- | --------- | --------- |
| Commercial recredentialing | \~3 years | 90 days |
| Medicaid MCO recredentialing | \~3 years | 90 days |
### Per entity
| Item | Cadence | Lead time |
| ------------------------------------ | -------------------------------- | --------- |
| **Medicare revalidation** | 5 years (3 for DMEPOS) | 90 days |
| **Medicaid revalidation** | At least 5 years, state-specific | 90 days |
| Payer contract renewal / rate review | Annual | 90 days |
| State annual report | Annual, per state | 60 days |
| Franchise tax | Annual, per state | 30 days |
| Registered agent renewal | Annual | 30 days |
| Business licenses | Varies | 30 days |
| Facility licenses where applicable | Varies | 60 days |
### Ongoing, monthly
| Check |
| ----------------------------------------------------------- |
| **OIG LEIE** exclusion screening, all staff and contractors |
| **SAM.gov** debarment screening |
| State Medicaid exclusion lists |
| License status spot-check |
## The two highest-risk items
**CAQH attestation** expires roughly every 120 days and, when it lapses, makes profiles invisible to payers **mid-credentialing**. It is the highest-frequency item on this page and the one most often missed.
**Medicare revalidation** notices go to the correspondence address in PECOS. If nobody monitors that address, the first you'll hear is when **billing privileges are deactivated** and claims stop. Confirm the address is monitored, and check your due date directly in the [Medicare Revalidation Lookup Tool](https://data.cms.gov/tools/medicare-revalidation-list) rather than waiting for a notice.
## Build the system
| Scale | Tool |
| ------------------------------ | --------------------------------------------------------------------- |
| 1–5 clinicians, 1 entity | Spreadsheet plus calendar reminders |
| 5–20 clinicians, 1–3 entities | Spreadsheet plus a task system, or entry-level credentialing software |
| 20+ clinicians, or 3+ entities | **Credentialing software** |
The crossover is where the grid exceeds a few hundred rows. Past that, manual tracking fails not because anyone is careless but because the volume exceeds what review catches.
Six columns minimum: **Item · Entity or person · Jurisdiction or payer · Due date · Lead time · Owner**.
Plus status and last-verified date.
A reminder on the due date is a reminder you're late. Use the lead times above.
"Operations" is not an owner. A person is. Include a backup for anything whose lapse stops revenue.
Add "review the next 60 days of the compliance calendar" to the month-end close checklist.
Quarterly, spot-check a sample against primary sources — the licensing board, PECOS, CAQH. Your grid records what someone entered; the source records what is true.
Before they start, not after. The setup step is where drift begins.
## Recovering from a lapse
| Lapse | Immediate action |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| **License expired** | **Stop the clinician from practicing.** Renew immediately. Assess claims billed during the lapse: they may be unbillable and may need to be refunded. |
| **CAQH attestation lapsed** | Re-attest immediately; notify payers with pending applications |
| **Medicare revalidation missed** | Submit immediately; deactivation is possible and reactivation may not be fully retroactive |
| **Malpractice lapsed** | Stop clinical work until reinstated; notify payers if coverage falls below their minimums |
| **DEA expired** | Stop prescribing controlled substances immediately |
| **Recredentialing missed** | Contact the payer; you may be terminated from the network |
| **Annual report missed** | File immediately with any late fee, before administrative dissolution |
**A lapsed license means claims for services during the lapse may be unbillable, and services already paid may be subject to refund.** Discovering an overpayment starts the 60-day report-and-return clock for Medicare and Medicaid. See [Report and return overpayments](/guides/compliance/report-and-return-overpayments).
## Verify it worked
* [ ] Every item above is in the tracking system
* [ ] Alerts set on lead time, not due date
* [ ] Named owner and backup per row
* [ ] Monthly review is part of the close checklist
* [ ] Quarterly primary-source spot-check running
* [ ] PECOS correspondence address monitored by a named person
* [ ] Monthly exclusion screening documented
* [ ] New hires and new entities added at onboarding
## Common failure modes
| Failure | Consequence |
| ------------------------------------------- | ----------------------------------------- |
| Spreadsheet outgrown but not replaced | Rows silently missed |
| Alerts on the due date | Always late |
| No named owner | Nobody acts |
| PECOS address unmonitored | Deactivated billing privileges |
| Exclusion screening at hire only | Post-hire exclusion undetected |
| New entity not added at setup | Its obligations tracked by nobody |
| Grid never verified against primary sources | Records what was entered, not what's true |
## Related topics
- [Set up your compliance calendar](/start/first-90-days/compliance-calendar.md)
- [Set up and maintain CAQH profiles](/guides/enrollment/set-up-caqh.md)
- [Credential each new provider you hire](/guides/enrollment/credential-new-providers.md)
- [Enroll in Medicare (PECOS)](/guides/enrollment/enroll-in-medicare.md)
- [Payer enrollment & submission links](/reference/payers/enrollment-links.md)