> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up your compliance calendar
> Build the recurring-obligation calendar (entity filings, license renewals, CAQH re-attestation, payer revalidations, insurance, and training) before anything lapses.
A **compliance calendar** is a single tracked list of every recurring obligation across both entities, every clinician, and every payer. Groups that don't build one in the first 90 days discover it in year two, usually because a license lapsed, a CAQH attestation expired mid-credentialing, or a Medicare revalidation deadline passed and billing privileges were deactivated.
## Why this is worse in an MSO-PC group
A single practice has one entity's filings and a handful of clinician credentials. An MSO-PC group multiplies almost everything:
* **Per entity:** annual reports, franchise taxes, registered agent renewals, foreign qualifications, times (number of PCs + 1)
* **Per clinician:** license, DEA, board certification, malpractice, CAQH, times every clinician
* **Per clinician per payer:** recredentialing, times every payer
* **Per entity per payer:** revalidations and contract renewals
A five-state group with fifteen clinicians and eight payers is tracking several hundred dated obligations. A spreadsheet works until it doesn't; credentialing software exists for exactly this reason.
## The obligations
### Corporate, per entity
| Obligation | Typical cadence | Consequence of missing |
| ---------------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| State annual report / statement of information | Annual (varies; some biennial) | Late fees, then administrative dissolution |
| Franchise tax | Annual | Penalties, loss of good standing |
| Registered agent renewal | Annual | Missed service of process |
| Foreign qualification annual report | Annual, per state | Loss of authority to do business |
| Board and shareholder minutes | Annual minimum | Weakens corporate formalities, see [Maintain corporate formalities](/guides/formation/maintain-corporate-formalities) |
| Beneficial ownership reporting | As required, confirm current status | Verify with counsel; requirements changed materially since 2024 |
**Administrative dissolution of a PC is a revenue event, not a paperwork event.** A dissolved entity's payer contracts and billing privileges are at risk, and reinstatement plus payer notification can take months. Set the annual report reminder 60 days early.
### Clinician credentials, per clinician
| Obligation | Typical cadence | Notes |
| -------------------------- | ------------------------- | ----------------------------------------------------------------------- |
| State professional license | 1–3 years, state-specific | Track per state for multi-state clinicians |
| DEA registration | 3 years | Plus state controlled-substance registrations where required |
| Board certification | Varies by board | Some payers require it |
| Malpractice insurance | Annual | Watch limits against payer minimums; track tail on claims-made policies |
| **CAQH re-attestation** | **\~Every 120 days** | The most frequently missed item on this page |
| CME | Per state board | Required for license renewal |
| BLS/ACLS where applicable | 2 years | |
### Payer, per clinician per payer, and per entity per payer
| Obligation | Typical cadence |
| ------------------------------------ | -------------------------------------------------------------- |
| Commercial recredentialing | \~Every 3 years |
| **Medicare revalidation** | Every 5 years for most providers; every 3 for DMEPOS suppliers |
| Medicaid revalidation | At least every 5 years, state-specific |
| Payer contract renewal / rate review | Annual, per contract |
| EFT/ERA re-verification | Occasional; triggered by bank changes |
**Medicare revalidation notices go to the address in PECOS.** If nobody monitors that address, the first you'll hear about it is when billing privileges are deactivated. Confirm the correspondence address in PECOS is one a human reads, and check your revalidation due date directly in the [Medicare Revalidation Lookup Tool](https://data.cms.gov/tools/medicare-revalidation-list).
### Ongoing monitoring, monthly
| Check | Why |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **OIG LEIE exclusion screening** for all staff and contractors | Employing an excluded individual creates civil monetary penalty exposure. [Search LEIE](https://exclusions.oig.hhs.gov/) |
| **SAM.gov debarment screening** | Same exposure for federal programs |
| State Medicaid exclusion lists | Many states maintain their own |
| License status spot-check | Catches actions between renewal dates |
Monthly is the widely recommended cadence for exclusion screening. Document each check with a date and a screenshot or report — an undocumented check is one you cannot prove you did.
### HIPAA and compliance program
| Obligation | Cadence |
| --------------------------- | -------------------------------- |
| Security risk analysis | Annual, and on material change |
| Workforce HIPAA training | Annual, plus at onboarding |
| BAA inventory review | Annual, plus on every new vendor |
| Policy review and update | Annual |
| Incident response plan test | Annual |
See [Build a minimum viable HIPAA program](/guides/compliance/build-a-hipaa-program).
### Structural review, the one nobody calendars
| Obligation | Cadence | Why |
| ---------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------- |
| **MSA and agreement stack review** | Annual, plus on any state law change | CPOM law is moving fast. An MSA drafted in 2023 may not comply in Oregon, California, or Vermont today. |
| CPOM self-audit | Annual | See [Run a CPOM self-audit](/guides/compliance/run-a-cpom-self-audit) |
| Management fee FMV review | Annual, and before any fee change | See [Set the management fee](/guides/agreements/set-the-management-fee) |
| State legislation scan | Quarterly | See the [legislation tracker](/reference/legal/cpom-legislation-tracker) |
The 2025–2026 legislative wave — Oregon SB 951, California SB 351, Vermont Act 133, and transaction-review laws in a growing list of states — made this the highest-value recurring review on the list. Structures that were compliant when drafted are not automatically compliant now, and Oregon's compliance deadline for pre-existing arrangements is January 1, 2029.1
## Build it in an hour
Obligation · Entity or person · Jurisdiction/payer · Due date · Owner · Lead time
Every entity, every clinician, every payer. It will be longer than you expect. That is the point.
60 days for anything requiring a filing or a committee. 30 days for renewals. 14 days for attestations.
"Operations" is not an owner. A person is.
A shared calendar with alerts, a task system, or credentialing software. A spreadsheet nobody opens is not a calendar.
Add the coming 60 days to the monthly close checklist.
## Template
Copy this structure:
| Obligation | Entity / person | Jurisdiction / payer | Due | Lead | Owner | Status |
| ----------------------- | ---------------------------- | -------------------- | -------------- | ---- | -------- | ------ |
| CO annual report | Meridian Dermatology PC | Colorado SOS | Mar 31 | 60d | Alex | ☐ |
| DE franchise tax | Meridian Health Partners LLC | Delaware | Jun 1 | 30d | Alex | ☐ |
| Medical license renewal | Dr. Shah | Colorado | Apr 30 | 60d | Dr. Shah | ☐ |
| DEA renewal | Dr. Shah | Federal | Sep 15 | 60d | Dr. Shah | ☐ |
| CAQH re-attestation | Dr. Shah | CAQH | Rolling \~120d | 14d | Biller | ☐ |
| Malpractice renewal | Meridian Dermatology PC | Carrier | Jan 1 | 60d | Alex | ☐ |
| BCBS recredentialing | Dr. Shah | Regional BCBS | 3 yr | 90d | Biller | ☐ |
| Medicare revalidation | Meridian Dermatology PC | CMS | 5 yr | 90d | Biller | ☐ |
| OIG/SAM screening | All staff | Federal | Monthly | — | Ops | ☐ |
| MSA review | Both entities | Counsel | Annual | 30d | Alex | ☐ |
| CPOM self-audit | Both entities | — | Annual | 30d | Alex | ☐ |
## You've finished the first 90 days
You have a billing rhythm, a denial process with a prevention loop, a refund process, a monthly close that reconciles three ways, and a calendar that will keep you out of the two most common self-inflicted crises in this industry: a lapsed credential and an out-of-date MSA.
## Next
Why the second state means a whole new PC, and everything that comes with it.
## Sources
1. Or. S.B. 951 (2025 Reg. Sess.), with compliance for arrangements pre-dating June 9, 2025 required by January 1, 2029. [Enrolled bill](https://olis.oregonlegislature.gov/liz/2025r1/Downloads/MeasureDocument/SB951); Holland & Knight, [An Update on the Implementation and Implications of Oregon's New CPOM Laws](https://www.hklaw.com/en/insights/publications/2026/05/an-update-on-the-implementation-and-implications-of-oregons) (May 2026).
## Related topics
- [Track licenses, revalidations, and expirables](/guides/enrollment/maintain-revalidations.md)
- [Maintain corporate formalities](/guides/formation/maintain-corporate-formalities.md)
- [Run a CPOM self-audit](/guides/compliance/run-a-cpom-self-audit.md)
- [When to call a lawyer (a triage map)](/concepts/compliance/when-to-call-a-lawyer.md)
- [CPOM & MSO legislation tracker](/reference/legal/cpom-legislation-tracker.md)
- [The complete agreement stack (checklist)](/reference/legal/agreement-stack-checklist.md)