CAQH Is Now DataSpring: The 120-Day Rule Just Got Higher Stakes

CAQH became payer-owned in January 2026 and rebranded to DataSpring in June — a structural governance shift that raises the stakes of the 120-day re-attestation requirement most practices already underestimate. A lapsed profile freezes credentialing across every connected payer simultaneously, often with no warning until claims start denying.

CAQH is now payer-owned

This happened with almost no provider-facing coverage, which is exactly why it matters to flag clearly. On January 6, 2026, CAQH announced it had converted from a nonprofit into a for-profit company, now owned by twelve shareholder companies affiliated with the nation's largest health plans — including UnitedHealth Group, Centene, Aetna, Elevance Health, Cigna, and Humana, along with a Blue Cross Blue Shield bloc. The new board is chaired by a UnitedHealth Group executive, with a Centene executive as Vice Chair. Five months later, on June 8, 2026, the platform rebranded as DataSpring, powered by CAQH — the same ProView portal, the same provider records, the same login, under a new name.

For more than 25 years, CAQH functioned as a neutral industry utility that both providers and payers relied on. That structure no longer exists in the same form. The practical concern industry observers have raised since the announcement is straightforward: the organizations that now govern the credentialing data platform are the same organizations that decide whether a provider stays enrolled, listed in a directory, and paid. One credentialing executive's January 2026 analysis put it directly — payer interests shaping the governance of the platform may mean less tolerance for the kind of data inaccuracies that were previously just an inconvenience. The login, the profile, and the 120-day schedule itself haven't changed. What's changed is who's setting the policy around what happens when a profile lapses.

The 120-day rule, exactly

Re-attestation is required at least every 120 days in most states (180 days in Illinois), and the cycle is deliberately not tied to any calendar period that's easy to track mentally — it isn't quarterly, it isn't tied to a renewal month, it's simply 120 days from the last attestation date. That's precisely why it gets missed: a system built around remembering rather than a recurring trigger fails eventually, usually during a busy stretch or a staff transition. Attestation itself is a literal legal action, not a formality — logging in, confirming every section is current, and electronically signing a statement that the data is accurate. Before the system allows attestation at all, it checks that every profile section is complete, no required documents (license, DEA, malpractice) have expired, and no data validation errors exist anywhere in the profile. An expired malpractice certificate or a lapsed license blocks attestation entirely, turning what should be a five-minute task into a scramble to track down a renewed document while the clock keeps running.

What actually happens when it lapses

Nothing breaks loudly. That's the part that catches practices off guard. Claims for payers already enrolled keep processing for a period, patients keep getting scheduled, and there's typically no direct warning email flagging the lapse as it happens. The damage is invisible for weeks before it surfaces as a pattern: a new payer application that quietly stopped moving, a re-credentialing cycle that stalled without explanation, or — eventually — claims from multiple payers denying within the same short window, all tracing back to the same root cause.

Recovery from a directory removal in particular can take weeks even after the underlying attestation is fixed, since reactivating the CAQH profile doesn't immediately update every payer's own directory refresh cycle.

The reminder cadence that actually works

CAQH's own email reminders exist, but treating them as the only safeguard is a known failure point — they're easy to miss in a busy inbox, and they don't account for staff turnover or someone simply being on leave when the email arrives. A more reliable structure sets three separate triggers after every attestation: a day-90 reminder as a heads-up to start reviewing the profile for anything that's changed, a day-100 reminder as the actual action trigger to log in and re-attest, and a day-110 reminder as a safety net in case day 100 was missed. For practices managing multiple providers, each individual clinician has a separate CAQH profile and a separate attestation clock — there's no shared or group-level attestation, which means a tracking system has to monitor each provider's deadline independently rather than assuming one practice-wide date covers everyone.

Recovering from a lapse

A lapsed attestation is recoverable, and reactivation within CAQH itself is immediate once completed — the profile status returns to currently attested within minutes of logging in, resolving any validation errors, and re-attesting. The real cost isn't the reactivation step itself, it's the days the profile sat inactive before anyone noticed, since every day adds to the cleanup work required with each individual payer afterward. After reactivating, checking in directly with the practice's highest-volume payers — rather than assuming the corrected status will be visible to them immediately — closes the gap faster than waiting for an automatic data pull on their end.

Never miss another re-attestation deadline.

We track every provider's CAQH re-attestation window and complete it before the clock runs out — across your entire roster, not just the providers someone remembers to check.