How Much of Medicare's Revalidation List Is Already Expired?

CMS points every enrolled provider at one file to find out when their billing privileges expire.

The September edition went into the data catalog today.

2,943,135 rows. 277,795 of them carry an actual date, and the other 2,665,340 say TBD.

Of the dated ones, 233,446 are already in the past.

That is 84% of everything on the file that looks like a deadline, and the oldest of them came due on 07/31/2023 (chart below).

The Front Edge Moves and the Back Edge Never Does

Run the September file against August's and the whole mechanism is one line of arithmetic.

August's newest due date was 01/31/2027. September's is 02/28/2027.

The file appended exactly one month-end and retired nothing.

7,811 rows now sit on that new date. 5,115 of them read TBD a month ago. Another 1,050 were already carrying a date, and all of it was old: 666 from 2023, 376 from 2024.

That second group is the five-year clock coming back around. Those providers revalidated once, CMS has now set their next date, and the row updated in place with the expired one written over.

Nobody else loses theirs. Across 2.9 million rows, exactly one enrollment went from a real date back to TBD between the two editions.

So the dated population only grows: 265,004 in July, 270,992 in August, 277,795 now.

The expired dates sit in the same column as the live ones, with nothing on the row to tell them apart.

There is a column that could have done that work. Adjusted Due Date is populated on 0 of the 2,943,135 rows.

Six Months, Seven Months, or Every Two Months

Three CMS surfaces describe this file and none of them agree.

The data catalog entry says it "contains revalidation due dates for Medicare providers who are due to revalidate in the following six months." The Revalidations page says "CMS posts revalidation due dates seven months in advance." The methodology PDF splits the difference at "six to seven months," then adds that the lists "are refreshed every two months and two months' worth of due dates are appended."

The observed behavior is monthly, one month-end at a time. And the six-versus-seven gap resolves cleanly once you look at when the file was actually built: this edition's HTTP timestamp is August 21, and counting forward from that day it carries seven future month-ends, 08/31/2026 through 02/28/2027.

By the time it reached the catalog on September 1, one of those seven had already expired. Which is the file's entire problem in miniature.

The 21,885 With a Live Clock

CMS's instruction to providers is specific. Revalidate if you are within three months of your due date, even without a notice.

Do not revalidate if your date is more than seven months out, because those get returned unprocessed.

Three month-ends fall inside that window on the September file: 09/30, 10/31 and 11/30/2026. 21,885 rows.

The full six-month block of 44,349 skews hard toward the organizational enrollments a billing office actually manages:

Clinic/Group Practice, 21,498 rows
Pharmacy, 6,489
Mass Immunization roster billers, 2,885
Ambulance suppliers, 1,631
Independent clinical labs, 1,217

DMEPOS is the population to check first. It is 70,679 rows on the file and 58,111 of them are dated, an 82% hit rate against 7.1% for Non-DME Part B, because suppliers run a three-year cycle against everyone else's five.

Final Thoughts

The penalty here has not moved in years and it is still the harshest one in enrollment.

Miss the date and you get a payment hold or a deactivation, you re-file a complete application to come back, and Medicare pays nothing for services furnished while you were deactivated. No exemptions, no extensions.

Against that, the lookup surface is a 275MB CSV where five of every six dated rows point at a deadline that closed as long as three years ago, and where your own row will tell you TBD until roughly seven months out.

Your MAC will send a notice three to four months ahead. CMS says in the same breath that tracking the date is your job.

Thanks for reading.