PECOS
PECOS (Provider Enrollment, Chain, and Ownership System) is Medicare's online enrollment system for providers and suppliers, handling initial enrollment, changes, reassignments, and revalidation. The PECOS 2.0 modernization now requires I&A credentials with multi-factor authentication and validates application data against IRS and NPPES records in real time.
- Runs
- Medicare enrollment (855I/855B/855R/855O equivalents)
- Login
- I&A credentials + MFA (PECOS 2.0)
- Validates against
- IRS, NPPES, adverse-action databases
- Alternative
- Paper CMS-855 forms (much slower)
What is PECOS and what does it handle?
PECOS is the front door to billing Medicare. Nothing gets paid until the provider or group exists in it: initial enrollment (the electronic 855I for individuals, 855B for groups), reassignment of benefits to the group, ownership reporting, EFT setup, revalidation, and status tracking all run through it. It is separate from NPPES (where your NPI lives) and completely separate from CAQH, which serves commercial payers; the systems share data but require their own maintenance.
Paper CMS-855 forms still exist, but electronic filing is faster to process and, under PECOS 2.0, catches fatal data errors at submission instead of six weeks in.
What did PECOS 2.0 change?
PECOS 2.0 is CMS's ground-up modernization, and three changes matter operationally. First, access: I&A credentials plus multi-factor authentication are mandatory, and old logins are dead, so credentialing staff need surrogacy connections configured in I&A before crunch time. Second, validation: the system cross-checks your entries against IRS records, NPPES, and adverse-action databases in real time, so a legal business name that differs from the IRS CP-575 by one punctuation mark now stops you at submission. Third, the platform moved to cloud hosting in 2026, and organizations using IP allowlists had to update configurations for the migration.
The same 2026 rule cycle also tightened the surrounding compliance: adverse legal actions must generally be reported within 30 days, and CMS expanded its authority to deactivate enrollments after 12 months without claims. The full rundown is in our guide to PECOS 2.0 changes for 2026.
How do you file a PECOS application that does not bounce?
- Match the IRS exactly: legal business name and TIN as printed on the CP-575/147-C letter, not the DBA on the signage.
- Sync NPPES first: PECOS validates against your NPI record; update addresses and taxonomy there before filing.
- Upload the supporting documents once, correctly: bank letter or voided check matching the CMS-588, licensure, and any required certifications.
- E-sign promptly: applications sit unprocessed until every required signatory completes the electronic signature, and the authorized official is usually the bottleneck.
Timeline math for planning: a physician starting September 1 whose application is filed July 1 and processed in 60 days is payable from roughly the start date, with the 30-day retrospective window as a cushion. Filed on the start date itself, you are holding claims into November. The credentialing calculator turns these dates into projected cash-flow impact, and our credentialing service can run the whole sequence.
Why does PECOS matter even for providers who never bill Medicare?
Because Medicare denies claims where the ordering or referring provider is not enrolled in (or validly opted out of) Medicare. A hospitalist group's claims can deny because the referring community physician was never in PECOS. If a provider only orders and refers but does not bill, the streamlined 855O enrollment solves it. Check any NPI against the public Order and Referring file before assuming.
Frequently asked questions
Everything in the Medicare enrollment lifecycle: initial enrollment of physicians, non-physician practitioners, groups, and suppliers; reassignment of billing rights to a group; practice changes like new locations or banking (via CMS-588 EFT); revalidation; withdrawal; and checking enrollment status. It is the electronic equivalent of the CMS-855 paper form family.
Through the CMS Identity & Access (I&A) Management System credentials with multi-factor authentication; legacy username-only logins no longer work. Staff who manage enrollment for providers need surrogate connections established in I&A before they can touch the provider's PECOS record, so set those up before the day an application is due.
MACs typically process clean electronic applications in roughly 45 to 90 days, faster than paper. PECOS 2.0's real-time validation front-loads the pain: mismatches with IRS or NPPES data that used to surface as development requests weeks later now block or flag the submission immediately, which is annoying but ultimately faster.
You can hold claims: physicians and non-physician practitioners may bill retrospectively for up to 30 days before their enrollment effective date (90 days in declared disasters). Practical approach: see Medicare patients once the application is filed, hold the claims, and release them when the approval letter arrives. Watch timely filing on held claims.
Sources & further reading
Reviewed by the ImmediCare Solutions RCM team
Certified billers and coders handling claims across 50+ specialties nationwide. This entry is reviewed against current payer policy and CMS rules. Last review: Jul 5, 2026.
Stop losing revenue to problems like this.
A free billing audit shows exactly where your practice is leaking money — no cost, no commitment.
