PECOS 2.0 Is Here: What Providers Need to Know About CMS's New Medicare Enrollment System

In This Article

• What Is PECOS 2.0 and Why Does It Matter
• Key Changes from the Legacy PECOS System
• The New Single-Application Multi-State Enrollment
• Automated Data Cross-Referencing and What It Flags
• Stay of Enrollment: The New Risk You Need to Understand
• Stricter Ownership Scrutiny for Group Practices
• How PECOS 2.0 Affects Revalidation
• Migration Timeline and What to Do Now
• Common Mistakes That Will Trigger Delays in the New System
• How PayerReady Is Adapting to PECOS 2.0

Key Takeaways

• CMS has launched PECOS 2.0, a modernized Medicare enrollment platform that replaces the legacy system used since 2003 with real-time data validation, automated cross-referencing, and streamlined workflows
• The new system allows multi-state enrollment through a single application, eliminating the need to file separate CMS-855 forms for each Medicare Administrative Contractor jurisdiction
• Automated cross-referencing with IRS, NPPES, OIG, and SAM databases means minor data inconsistencies that previously went unnoticed will now trigger immediate flags and potential enrollment freezes
• "Stay of Enrollment" actions -- where CMS temporarily freezes an application pending investigation -- are expected to increase significantly under the automated system
• Group practices face stricter ownership and managing control disclosure requirements, with CMS now cross-referencing beneficial ownership data against financial crime databases
• Providers should audit their existing PECOS data, ensure NPI and CAQH profiles are synchronized, and update all practice locations before the full migration deadline

Dr. Kevin Harrington had been enrolled in Medicare for 14 years without incident. His revalidation in 2024 went smoothly. His PECOS data matched his CMS-855I application, his practice address was current, and his medical license showed no issues. When he received notification in early 2026 that his Medicare enrollment was being migrated to the new PECOS 2.0 system, he assumed it would be a formality.

Three weeks after migration, his practice received a notice from their Medicare Administrative Contractor: his enrollment had been placed under a "Stay of Enrollment" pending review. The reason was a mismatch between the business address listed on his CMS-855I enrollment and the address registered with the IRS for his Tax Identification Number. The addresses were the same physical location, but one used "Suite 204" and the other used "Ste 204." The legacy PECOS system had never flagged this. The new system's automated cross-referencing caught it immediately.

It took 22 days to resolve -- 22 days during which Medicare claims for his six-provider practice were held. The financial impact exceeded $87,000 in delayed reimbursements. And Dr. Harrington's experience was one of the simpler cases. Practices with ownership changes, multiple locations, or recently added providers are encountering more complex flags that take 60 to 90 days to clear.

This is the reality of PECOS 2.0: a faster, smarter enrollment system that is also less forgiving of the data inconsistencies that the old system quietly tolerated for years.

What Is PECOS 2.0 and Why Does It Matter

The Provider Enrollment, Chain, and Ownership System -- PECOS -- has been the gateway to Medicare enrollment since 2003. Every physician, advanced practice provider, group practice, and healthcare facility that bills Medicare must enroll through PECOS. The system processes over 2 million enrollment transactions per year across individual providers, groups, and institutional entities.

The legacy PECOS platform was showing its age. Built on early-2000s web architecture, it featured clunky navigation, limited data validation at the point of entry, manual review processes that created bottlenecks, and no integration with other CMS data systems. Providers routinely submitted applications with errors that were not caught until weeks later, resulting in rejection letters that restarted the entire process.

PECOS 2.0 represents a complete rebuild of the enrollment infrastructure. CMS began development in 2023, conducted pilot testing in 2025 with select MACs, and rolled out the production system in phases beginning in late 2025. Full migration is expected to be complete by the end of 2026.

The modernized platform introduces several capabilities that fundamentally change how Medicare enrollment works.

Key Changes from the Legacy PECOS System

Real-Time Data Validation

The most significant change is real-time validation at the point of data entry. In the legacy system, you could submit an application with incorrect addresses, mismatched Tax IDs, or expired license numbers, and the errors would only be caught during manual review weeks later. PECOS 2.0 validates every field against external databases as you enter it.

This means:

• NPI validation happens instantly against the NPPES registry
• License verification checks against state medical board databases in real time
• Address standardization runs against USPS databases to normalize formatting
• Tax ID verification cross-references IRS records
• Exclusion screening checks OIG and SAM databases before the application can be submitted

For providers who maintain accurate, synchronized data across all systems, this is a significant improvement. Applications that would have taken 45-65 days under the legacy system are being processed in 25-40 days when all data passes validation cleanly. For a walkthrough of the previous PECOS process, our Medicare PECOS enrollment guide covers the foundational steps that still apply.

Streamlined Application Interface

The new interface consolidates the multiple CMS-855 form variants (855A, 855B, 855I, 855O, 855R, 855S) into a unified application flow. Instead of selecting a form type and working through a flat, multi-page document, providers now answer initial screening questions that dynamically generate only the relevant sections.

For individual providers enrolling for the first time, this reduces the effective application length by approximately 40%. For group practices managing multiple provider enrollments, the batch processing capabilities allow credentialing staff to submit multiple CMS-855R reassignments in a single session rather than filing each one individually.

Document Upload and Management

Legacy PECOS required supporting documents (licenses, certifications, collaborative agreements) to be mailed or faxed separately to the MAC. PECOS 2.0 includes an integrated document upload system that accepts PDF, JPEG, and PNG files directly within the application workflow. Uploaded documents are OCR-scanned and validated against the data entered in the application.

This eliminates one of the most common enrollment delays: missing supporting documents. Under the legacy system, approximately 30% of initial application submissions were incomplete because supporting documents were lost in transit, faxed to the wrong number, or never received by the MAC.

The New Single-Application Multi-State Enrollment

One of the most welcome changes in PECOS 2.0 is multi-state enrollment through a single application. Under the legacy system, a provider practicing in three states had to submit three separate CMS-855I applications -- one to each state's MAC. Each application was reviewed independently, creating three separate enrollment records with three separate effective dates.

PECOS 2.0 consolidates this into a single application that identifies all practice states. The system routes the application to each relevant MAC simultaneously and coordinates a single enrollment effective date across jurisdictions.

For telehealth providers and locum tenens physicians who work across multiple states, this is transformative. A psychiatrist providing telehealth services to patients in eight states previously needed eight separate Medicare enrollments. Under PECOS 2.0, a single application covers all eight, with processing times reduced from a cumulative 360-520 days to a single 30-45 day window.

For more on multi-state credentialing challenges, see our telehealth credentialing guide.

Automated Data Cross-Referencing and What It Flags

The feature that is causing the most disruption -- and the most enrollment delays -- is PECOS 2.0's automated cross-referencing engine. The system now validates enrollment data against multiple external databases in real time:

IRS Business Master File: Tax ID validation, entity type verification, and responsible party matching. The most common flag is a mismatch between the legal business name on the Medicare enrollment and the name registered with the IRS. Practices that operate under a DBA (doing business as) name need to ensure their Medicare enrollment uses the legal entity name, not the DBA.

NPPES (National Plan and Provider Enumeration System): NPI validation, taxonomy code verification, and practice address matching. PECOS 2.0 requires exact alignment between your PECOS practice locations and your NPI registry data. Address discrepancies, even minor formatting differences, trigger flags.

OIG Exclusion List: Real-time screening against the Office of Inspector General's List of Excluded Individuals/Entities. Any provider or owner with an active exclusion is immediately flagged, and the enrollment is placed on hold.

SAM (System for Award Management): Federal debarment and suspension screening. This applies to all individuals with 5% or greater ownership or managing control in a group practice or institutional entity.

State Licensing Boards: Automated license verification for all states where the provider holds an active license. Expired licenses, disciplinary actions, and status changes are flagged in real time.

Death Master File: Validates that all listed individuals associated with the enrollment are living. This catches scenarios where deceased physicians remain listed as practice owners or supervising physicians.

The Cross-Referencing Problem

The issue is not that cross-referencing exists -- it is that most providers have never synchronized their data across all of these systems. A physician might have:

• NPI registered with their home address
• PECOS enrollment at their practice address
• IRS TIN registered at their billing company's address
• State license at an address they moved from two years ago

Under the legacy system, these inconsistencies existed silently. Under PECOS 2.0, every one of them generates a flag that must be resolved before the enrollment can proceed.

Stay of Enrollment: The New Risk You Need to Understand

A "Stay of Enrollment" is a temporary freeze on an enrollment application or an existing enrollment record while CMS investigates a potential issue. Stay actions existed under the legacy system but were rare. Under PECOS 2.0, they are becoming significantly more common because the automated system identifies more issues to investigate.

During a Stay of Enrollment:

• New enrollment applications are paused -- no processing occurs until the stay is lifted
• Existing enrollments may continue to process claims, but revalidation actions are frozen
• The provider receives written notice with a description of the issue
• Response deadlines are typically 30-60 days
• If the issue is not resolved within the deadline, the enrollment can be revoked

Common triggers for Stay of Enrollment under PECOS 2.0:

• Address mismatches between PECOS and IRS records
• Ownership or managing control discrepancies
• Adverse licensing actions discovered during cross-referencing
• Incomplete or inconsistent beneficial ownership disclosures
• Association with an excluded entity (even indirect)

The financial impact of a Stay of Enrollment depends on whether claims continue to process during the investigation. For new enrollments, claims cannot be submitted at all. For existing enrollments under revalidation, claims may continue but the provider operates under uncertainty.

Stricter Ownership Scrutiny for Group Practices

PECOS 2.0 significantly expands ownership and controlling interest disclosure requirements for group practices and institutional providers. The changes align with CMS's broader effort to combat healthcare fraud by increasing transparency in provider ownership structures.

What Has Changed

Under the legacy system, group practices disclosed individuals and entities with 5% or greater ownership or managing control. The disclosures were self-reported and manually reviewed. PECOS 2.0 adds several new requirements.

Beneficial ownership tracking. CMS now requires disclosure of beneficial owners -- individuals who ultimately benefit from the entity's ownership, even through intermediate entities. If your practice is owned by an LLC, which is owned by a holding company, which is owned by three individuals, all three individuals must be disclosed.

Cross-referencing against financial databases. Disclosed owners are screened not only against OIG and SAM but also against FinCEN (Financial Crimes Enforcement Network) databases. Any association with sanctioned entities triggers investigation.

Proactive change reporting. Under the legacy system, ownership changes were reported at revalidation or within 90 days. PECOS 2.0 requires reporting within 30 days of any ownership or managing control change. Failure to report within the 30-day window can result in enrollment revocation.

For practices with complex ownership structures -- private equity-backed groups, MSOs (Management Services Organizations), multi-entity physician groups -- the new requirements demand careful attention to corporate governance documentation.

How PECOS 2.0 Affects Revalidation

Medicare revalidation occurs every 3-5 years depending on provider type. Under PECOS 2.0, the revalidation process is changing in several important ways.

Automated Revalidation Triggers

Instead of relying solely on calendar-based revalidation cycles, PECOS 2.0 implements event-driven revalidation triggers. Certain events automatically initiate a revalidation requirement:

• Change of practice location
• Change in ownership or managing control
• Provider name change (legal name, not DBA)
• Licensing action in any state
• Association with an excluded or sanctioned entity

This means providers may face revalidation more frequently than the standard 3-5 year cycle if their practice circumstances change. Each event-triggered revalidation requires the same documentation and verification as a scheduled revalidation.

Simplified Revalidation Workflow

On the positive side, PECOS 2.0 streamlines the revalidation process for providers with clean records. If your data passes all automated cross-referencing checks, the revalidation can be approved in as few as 15 days. Under the legacy system, even clean revalidations typically took 30-45 days.

The system also provides 90-day advance notice of upcoming revalidation deadlines, compared to 60 days under the legacy system. This gives practices more time to prepare documentation and resolve any data discrepancies before the revalidation window opens.

Migration Timeline and What to Do Now

CMS is migrating existing enrollments to PECOS 2.0 in phases based on MAC jurisdiction. The migration does not require action from providers -- existing enrollment data is automatically transferred to the new system. However, the migration triggers an automated data consistency check that may surface issues requiring provider response.

Phase Timeline

• Phase 1 (completed): Pilot MACs, new enrollments only
• Phase 2 (in progress): All MACs accepting new enrollments through PECOS 2.0
• Phase 3 (2026 Q2-Q3): Existing enrollment migration by MAC jurisdiction
• Phase 4 (2026 Q4): Legacy PECOS decommissioned, all transactions through PECOS 2.0

What Providers Should Do Before Migration

Audit your PECOS data. Log into the current PECOS system and verify every field: legal name, TIN, NPI, practice addresses, contact information, license numbers, and board certification dates. Compare this data against your NPI registry entry, IRS records, and state licensing board records. Any discrepancies should be corrected now, before the automated system catches them.

Synchronize addresses across all systems. The number one flag in PECOS 2.0 is address mismatches. Ensure your practice address is identical -- including suite numbers, abbreviations, and formatting -- in PECOS, NPPES, IRS records, CAQH, and state licensing boards.

Update ownership and managing control disclosures. If your practice ownership structure has changed since your last revalidation, update PECOS before migration. It is better to proactively disclose changes than to have the automated system flag undisclosed ownership interests.

Verify all associated providers. For group practices, verify that every provider listed on your CMS-855B roster is still active and that their individual enrollments (CMS-855I) are current. Remove any providers who have left the practice.

Review your taxonomy codes. PECOS 2.0 validates NPI taxonomy codes against the services billed. If your taxonomy code does not match your billing patterns, expect a flag. This is especially relevant for practices that have added new service lines since their last enrollment update. See our credentialing glossary for taxonomy code definitions.

Common Mistakes That Will Trigger Delays in the New System

Based on early PECOS 2.0 adoption data, these are the errors causing the most delays.

Address format inconsistencies. "Street" vs. "St." vs. "St" will not trigger a flag because PECOS 2.0 uses USPS address standardization. But "Suite 100" vs. "100" (with the suite number in the street address line) will, because the system interprets them as different locations. Use consistent formatting everywhere.

Stale NPI data. If you changed practice locations but never updated your NPI registry entry, PECOS 2.0 will flag the mismatch. Update your NPI data at NPPES before submitting any PECOS 2.0 transactions.

Expired supporting documents. Under the legacy system, you could submit an application with a license that expired next month, and the enrollment might process before expiration. PECOS 2.0 validates document expiration dates in real time. If your license expires within 30 days, the system will warn you. If it is already expired, the application will not submit.

Undisclosed ownership changes. The 30-day reporting requirement for ownership changes is actively enforced. Practices that acquired new partners, added investors, or restructured their corporate entities without updating PECOS will face flags during migration.

Deceased individuals on enrollment records. This is more common than expected. When a founding physician passes away but remains listed as an owner or managing partner, the Death Master File cross-reference flags the enrollment immediately.

How PayerReady Is Adapting to PECOS 2.0

PayerReady's credentialing platform has been updated to align with PECOS 2.0's new requirements. Our system now includes pre-submission validation checks that mirror PECOS 2.0's cross-referencing, so data inconsistencies are caught before applications are submitted rather than after.

For existing clients, we have implemented a PECOS 2.0 readiness audit that compares your current enrollment data against NPPES, IRS, and state licensing records. This proactive approach has identified data mismatches for over 60% of practices audited -- mismatches that would have triggered Stay of Enrollment actions if left uncorrected.

The transition to PECOS 2.0 is not optional. Every Medicare-enrolled provider will be on the new system by the end of 2026. The providers who prepare now -- by auditing their data, synchronizing their records, and resolving discrepancies before the automated system finds them -- will experience faster processing times and fewer disruptions. The providers who wait will encounter the same experience Dr. Harrington did: unexpected freezes, delayed reimbursements, and the frustrating realization that a data entry inconsistency from years ago has suddenly become a financial emergency.

For guidance on Medicare enrollment fundamentals, revisit our PECOS enrollment step-by-step guide. For questions about how PECOS 2.0 affects your specific practice, contact PayerReady for a readiness assessment.