PECOS 2.0 in 2026: The AWS Migration and What Actually Changed

CMS completed PECOS 2.0's migration to AWS cloud infrastructure on May 4, 2026 — a genuine infrastructure change, not a cosmetic update. Practices using fixed IP allowlists, skipping multi-factor authentication setup, or still submitting the old standalone CMS-855R form are the ones hitting avoidable enrollment delays right now.

The May 2026 AWS migration

CMS officially completed PECOS 2.0's migration to Amazon Web Services cloud infrastructure on May 4, 2026 — a structural infrastructure change, not a surface-level update. The practical consequence that catches practices off guard: PECOS now responds from dynamic AWS IP ranges rather than the fixed, legacy CMS addresses many organizations had allowlisted in their corporate firewalls. Any practice or billing team that restricts outbound or inbound access by a hardcoded IP allowlist needs to update that network configuration, or logins and submissions can silently fail without an obvious error pointing back to the actual cause. This is exactly the kind of change that's invisible until it isn't — an IT department that wasn't looped in on the credentialing team's PECOS dependency has no reason to know this matters.

Mandatory MFA on every login

Multi-factor authentication through the Identity and Access (I&A) Management system is now strictly required for every PECOS login, not an optional security enhancement. This applies to every user touching the system — credentialing staff, billing personnel, and any delegated or authorized official, not only the enrolling provider. An old-style username-and-password-only login simply doesn't work anymore. Practices that haven't proactively set up I&A-linked MFA for every staff member who needs PECOS access are the ones finding out mid-application, at the exact moment speed matters most.

The CMS-855R merger that still trips people up

This change isn't new for 2026, but it's still actively causing rejected applications, which is why it's worth restating plainly: CMS merged the standalone CMS-855R (Reassignment of Medicare Benefits) form into the CMS-855I for paper enrollment workflows. Individual practitioners reassigning their billing rights to a group or organization on a paper application no longer file a separate CMS-855R — that information is now captured directly within the CMS-855I itself, through Section 4F and the related signature sections. Submissions still using the old standalone CMS-855R format, or referencing the pre-merger form structure, are returned to the provider with instructions to resubmit on the current consolidated form — a fully avoidable restart of the clock. The merger does not apply to terminating an existing reassignment, which still requires the CMS-855R specifically in most cases — an important distinction that's easy to miss if a team assumes the merger eliminated the CMS-855R from every use case.

Real-time IRS and NPPES cross-referencing

PECOS 2.0 now validates application data against IRS and NPPES records in real time as it's entered, rather than surfacing mismatches only after a manual review cycle. A provider's legal name, SSN, Tax Identification Number, and Legal Business Name must match exactly across PECOS, NPPES, and IRS records — a discrepancy as small as a missing middle initial or an outdated business name following a legal entity change is enough to trigger a rejection. This makes data governance, not form-filling, the actual bottleneck in 2026: an application is only as fast as the underlying provider data is clean and consistent across every federal system it touches.

The 30-day reporting window

Changes to practice location, ownership structure, or final adverse legal actions must now be reported into PECOS within 30 calendar days. Missing that window doesn't just create a compliance gap — CMS has also expanded its deactivation authority to cover providers with 12 months of enrollment inactivity, meaning a credential that's been quietly unused, not just one with an expired attestation, can lapse without an active denial ever being the trigger. Building a recurring internal check for both reporting deadlines and inactivity risk, rather than relying on remembering to update PECOS after a change happens, is the only reliable way to stay ahead of this.

The 2026 application fee

The Medicare enrollment application fee for 2026 is $750, and it applies specifically to institutional providers (CMS-855A), group practices (CMS-855B), DMEPOS suppliers (CMS-855S), and Opioid Treatment Programs. Most individual physicians, non-physician practitioners, and physician organizations enrolling via CMS-855I are exempt from the fee in most cases. Hardship exceptions exist for the fee on a case-by-case basis, but a hardship request only initiates a review — it doesn't guarantee a waiver, and Medicare Administrative Contractors won't process the underlying application until either the fee is paid or an approved hardship exception is on file.

Don't let infrastructure changes stall your enrollment.

See your personalised credentialing timeline, or let us handle the PECOS, CAQH, and commercial payer applications in parallel from day one.