CAQH's 120-Day Clock: The Complete Re-Attestation Guide for Practices

Key Takeaways

• CAQH requires every provider to re-attest their profile every 120 days, roughly four times a year, or the profile goes stale and stops being usable by payers.
• Nothing visibly breaks on the day an attestation expires. The damage appears weeks or months later, when a recredentialing cycle stalls, a directory listing drops, or a new enrollment cannot be processed.
• CAQH sends reminder emails as the deadline approaches, but in busy practice inboxes they routinely go unread or land in spam. Missed reminders are the single most common way the clock runs out.
• Re-attestation is not just clicking a button. Supporting documents such as malpractice insurance certificates must be current, or the attestation is effectively incomplete.
• A solo provider can almost manage this in a calendar. A group with ten or twenty clinicians has dozens of overlapping 120-day clocks, and one missed date can pause billing for a full caseload.
• The reliable fix is treating attestation as a monitored, owned process rather than a reminder email and good intentions.

What is CAQH re-attestation?

CAQH re-attestation is the act of logging into your CAQH profile, confirming that every piece of information in it is still accurate, and electronically signing that confirmation. CAQH requires this every 120 days. When you attest, the clock resets. When you do not, your profile expires and payers stop treating your data as current.

CAQH (the Council for Affordable Quality Healthcare) operates the provider data platform that most major commercial payers in the United States use as their source of truth for credentialing information. Providers know it as CAQH ProView, and more recently as the CAQH Provider Data Portal. Instead of sending your license, malpractice insurance, work history, and practice details to every payer separately, you maintain one CAQH profile and authorize payers to pull from it.

That design is genuinely useful. It also creates a single point of failure. When the one profile that feeds every payer goes stale, every process that depends on it inherits the problem at once.

Why does CAQH require re-attestation every 120 days?

The 120-day cycle exists because payers are required to credential providers using current information, and self-reported data ages quickly. Licenses renew or lapse. Malpractice policies roll over annually. Providers change practice locations, add supervising relationships, close panels, and update specialties. A profile attested a year ago is a snapshot of a practice that may no longer exist.

Rather than asking payers to chase every provider for updates, CAQH shifts the burden to a fixed rhythm: every 120 days, the provider confirms the record. Payers can then rely on any profile with a current attestation date. An expired attestation tells a payer the opposite: this data is not vouched for, do not use it.

Credentialing standards reinforce the rhythm. Accreditation frameworks that payers follow, such as NCQA's credentialing standards, require verification of current information within defined windows. The 120-day attestation is how the industry keeps self-reported data inside those windows at scale.

The practical takeaway: the 120-day clock is not CAQH bureaucracy for its own sake. It is the mechanism that lets one profile serve hundreds of payers. Which is exactly why letting it expire is more expensive than it looks.

What actually happens when your CAQH attestation expires?

Here is the part almost nobody explains clearly: nothing visible happens on day 121. No claim denies that morning. No payer calls. Your login still works. The practice feels no different.

The damage is downstream and quiet:

Recredentialing stalls. Payers recredential providers on a fixed cycle, typically every two to three years. When a payer's recredentialing process reaches for your CAQH data and finds an expired attestation, the file cannot move. Some payers reach out. Many simply let the file sit in a pending state while their own deadline approaches. If the recredentialing window closes with the file incomplete, the payer can terminate the provider's participation, and the practice discovers the problem as denied claims months after the original missed attestation.

New enrollments cannot be processed. If your practice is adding a payer, or adding a new clinician to an existing contract, the application depends on current CAQH data. An expired attestation adds days or weeks to a timeline that was already long, because the application waits while someone locates the person who can log in and attest.

Directory listings degrade. Payers use CAQH data to validate provider directory entries. Federal and state rules push payers to verify directory accuracy on a regular cycle, and an unattested profile fails that validation. Practices have found themselves quietly absent from a payer's directory while still in network, which costs referrals rather than claims and is even harder to notice.

The data itself decays. An expired attestation usually means nobody has looked at the profile in months. Meanwhile the malpractice certificate on file expired, the new office location never got added, and the roster still lists a clinician who left in the spring. When someone finally logs in to re-attest, they inherit an hour of cleanup instead of a five-minute confirmation.

The pattern across all four: the cost of a missed attestation arrives long after the miss, disconnected from its cause. Practices experience it as a payer problem, a claims problem, or a directory problem. The root was a 120-day clock that ran out unnoticed.

The 120-day timeline, in practice

Day 0. You attest. The clock resets. If your documents are current and your data is accurate, this took a few minutes.

The middle stretch. Nothing is required. This is also when things change in the real world: a clinician joins, a policy renews, an address moves. Best practice is updating the profile when changes happen rather than saving them all for attestation day, because payers pulling your data between attestations see whatever is in the profile right now.

The final weeks. CAQH sends automated reminder emails to the contact on file as the deadline approaches. This is the failure point in most missed attestations. The reminders go to an inbox nobody owns, or a former office manager's address, or a spam folder. In a practice handling hundreds of emails a day, an automated reminder about a task due in two weeks loses to everything that is due today.

Day 120. The attestation expires. Silently.

Day 121 and beyond. Every consequence in the previous section is now possible, on a delay, at a payer's convenience rather than yours.

If one habit changes because of this guide, make it this: do not let the reminder email be the system. The reminder email is a courtesy. The system is whatever your practice does that works even when the email is never seen.

How to re-attest: the practical steps

1. Log in to your CAQH profile with the provider's credentials. Group practices should know exactly who holds these credentials for each clinician before the deadline, not after.
2. Review every section, not just the summary. Practice locations, hospital affiliations, malpractice carrier and policy dates, work history, and roster relationships. Payers act on what is written here, not on what the practice knows.
3. Check the document library. The most common silent failure is an expired malpractice certificate of insurance. An attestation with expired supporting documents is an invitation for a payer to reject the data anyway. Upload current documents first.
4. Confirm payer authorizations. Each payer you work with needs authorization to access the profile. New payer relationship since last attestation means a new authorization to grant.
5. Attest. The electronic signature is the last step, not the whole task. It certifies everything above it.
6. Record the date and set the next one. The next deadline is 120 days out. Whatever tracking system the practice uses, it should now show the next date, the responsible person, and the credentials location.

A realistic time estimate for a well-maintained profile is ten to fifteen minutes. For a neglected one, an hour or more, usually at the worst possible time.

The group practice problem: many clocks, one calendar

For a solo provider, the 120-day clock is an annoyance. For a group, it is an operations problem that grows with every hire.

Twenty clinicians means twenty separate 120-day cycles, each started by a different original attestation date, each drifting relative to the others. Add license renewal dates, DEA expirations, malpractice policy rollovers, and each payer's own recredentialing calendar, and a mid-sized group is tracking well over a hundred dates where missing any single one has a revenue consequence.

Spreadsheets fail here in a predictable way: they depend on someone looking at them. The person who built the spreadsheet leaves, the tab stops being opened, and the system silently becomes no system at all. The failure mode of a spreadsheet is identical to the failure mode of the reminder email. Both work until the one week nobody looks.

This is why mature practices treat expirables tracking as a monitored process with an owner, not a document. Someone, or something, must be responsible for knowing every date, surfacing the ones that are close, and confirming completion rather than assuming it.

What a slipped attestation costs: three realistic scenarios

Scenario one: the recredentialing termination. A therapist in a twelve-clinician group has a payer recredentialing cycle come due in March. The payer's system reaches for CAQH data in January and finds an attestation that expired in November. Notices go to a portal inbox nobody checks. The recredentialing window closes, participation terminates, and the practice learns about it in May from a stack of denials. Claims from the gap period are not recoverable through appeal, because the termination was procedurally valid. The original failure was a five-minute attestation missed six months earlier.

Scenario two: the stalled new hire. A group hires a psychiatric nurse practitioner in August and submits enrollment applications to six payers. Four process normally. Two stall because the new clinician's CAQH profile, last touched at her previous employer, has an expired attestation and a malpractice certificate from a carrier she no longer uses. By the time anyone identifies why the two applications are quiet, the other four are approved and the practice has been scheduling around two missing networks for a month. The clinician sees patients whose claims cannot be billed to those payers, or the practice restricts her schedule and eats the idle capacity. Either way, the delay was self-inflicted.

Scenario three: the invisible directory drop. A payer's directory validation cycle fails against an unattested profile, and a practice location quietly disappears from the payer's find-a-provider tool. Nothing denies. Nothing terminates. New patient calls from that payer's members simply slow down, which the practice attributes to seasonality. The listing returns after the next attestation, and nobody ever connects the quiet quarter to the expired profile. This scenario is the most common and the least diagnosed, because its only symptom is absence.

The three scenarios share one property: by the time the cost is visible, the cause is months old and looks unrelated. That asymmetry, small cause now, large disconnected effect later, is the entire reason attestation deserves a system instead of a reminder email.

The attestation-day checklist

Run this every 120 days, per provider. It takes fifteen minutes when nothing has changed and prevents the hour-long version.

1. Confirm the login works and the credentials are documented where the practice can find them.
2. Verify personal and practice information: names, NPI, specialties, practice locations, phone numbers, billing address.
3. Verify the roster relationships: employer, group affiliations, supervising or collaborating clinicians where applicable.
4. Open the document library and check expiration dates on every document, especially the malpractice certificate of insurance and state licenses.
5. Upload replacements for anything expired or expiring within the next 120 days, so the next cycle starts clean.
6. Confirm payer authorizations include every payer the practice currently works with.
7. Attest, and save confirmation of the attestation date.
8. Write the next deadline, 120 days out, into whatever system the practice actually checks, with a named owner.

Groups should run the same checklist as a batch, sorted by soonest deadline, so one session clears every clinician approaching expiration rather than handling each as its own emergency.

CAQH and delegated credentialing

Larger groups sometimes hold delegated credentialing agreements, where a payer contractually hands the group (or a credentialing verification organization working for it) the authority to credential its own providers. Delegation changes who does the verification work. It does not make the CAQH clock irrelevant, and assuming it does is a quiet trap.

Three things stay true under delegation. First, not every payer delegates, so most groups run a hybrid: delegated with two or three large payers, conventional credentialing with everyone else, and the conventional payers still pull CAQH directly. Second, delegated agreements come with audit obligations, and auditors expect the underlying provider data to be current, which in practice keeps the CAQH profile in scope. Third, the group's own roster processes usually feed from the same profile data, so a stale profile propagates stale data into the group's own submissions.

The operating rule for delegated groups is the same as for everyone else, with one addition: track every clinician's 120-day clock as if no delegation existed, and document the attestation history, because at audit time the history is evidence.

A related edge case worth naming: clinicians who moonlight or hold positions across multiple organizations have one CAQH profile serving all of them. Whichever organization notices the expiring attestation first protects every organization that depends on that profile. In practice, whichever organization has a system notices, and the others benefit without knowing it.

Where PayerReady fits

PayerReady treats the CAQH clock as one of the expirables we watch continuously for every provider on a roster, alongside license renewals, DEA registrations, and payer recredentialing windows. Attestation deadlines are tracked per provider, surfaced weeks ahead, and confirmed done rather than assumed done. When our system sees a clock approaching, a human on your credentialing team acts on it, and the status your practice sees reflects what actually happened.

The reasoning is the same one that runs through this whole guide: the application is a moment, but eligibility is a continuous state. Getting in network is day one. Staying eligible is the other 364, and the 120-day clock is one of the few deadlines in healthcare that arrives four times a year, forever.

Frequently asked questions

How often does CAQH require re-attestation?

Every 120 days, which works out to roughly four times per year. The clock resets each time you attest.

Does CAQH remind me before my attestation expires?

Yes. CAQH sends automated reminder emails to the contact on file as the deadline approaches. Treat them as a courtesy rather than a system. They routinely go unread in busy inboxes, and a missed reminder does not extend the deadline.

What happens if my CAQH attestation expires?

Nothing visible on the day itself. Afterward, payers pulling your data see it as not current, which can stall recredentialing, delay new enrollments, and cause directory validation failures. The consequences typically surface weeks or months later.

Can a payer terminate my contract because of an expired attestation?

Not directly on the expiration date. But if an expired attestation causes your recredentialing file to remain incomplete past the payer's own deadline, the payer can terminate participation for failure to complete recredentialing. The attestation lapse is the root cause. The termination letter will not say so.

Do I still need to re-attest if nothing changed?

Yes. The attestation certifies that the data is current, and only the attestation date tells payers the profile can be relied on. No change in your practice does not pause the 120-day clock.

Who should own CAQH attestation in a group practice?

One named owner with access to every clinician's credentials, a tracked calendar of every 120-day date, and a confirmation habit, meaning the date is marked done when the attestation is completed, not when the reminder is forwarded. Many groups delegate this to a credentialing service precisely because the failure mode of internal tracking is silence.

Can someone attest on a provider's behalf?

Yes. Practice managers and credentialing staff routinely maintain profiles and complete attestations using the provider's credentials or delegated access, and credentialing services do the same at scale. The attestation still certifies the provider's information, so the provider remains responsible for its accuracy. The workable arrangement is delegated hands with provider awareness, not providers discovering years later what their profile says.

Does CAQH cost providers anything?

No. CAQH ProView is free for providers. Participating payer organizations fund the platform. The cost to a practice is entirely operational: the time to maintain profiles and the consequences of not maintaining them.

Is CAQH re-attestation the same as payer recredentialing?

No, and confusing them causes misses. Re-attestation is the 120-day confirmation of your CAQH profile. Recredentialing is each payer's own two-to-three-year cycle of re-verifying your credentials, which usually consumes your CAQH data as an input. Keeping the first current is a precondition for surviving the second.

Sources and further reading

• CAQH Provider Data Portal (ProView) provider documentation on attestation requirements
• NCQA credentialing standards on verification time limits
• CMS and state requirements on provider directory validation
• PayerReady internal enrollment and recredentialing casework, 2021 to 2026

PayerReady provides credentialing and payer enrollment for medical and behavioral health practices, with continuous monitoring of CAQH attestation, license and DEA expirations, and exclusion screening. Statuses that cannot lie, humans approving everything that matters.