A CMS-855 change of information is filed either electronically through PECOS at pecos.cms.hhs.gov or on the paper CMS-855 form that matches your enrollment type, sent to your Medicare Administrative Contractor. You do not refill the entire application: you complete the sections that are always required plus the section covering whatever data is changing, sign the certification, and submit within the deadline that applies to that change. Miss the deadline and Medicare can stay, deactivate, or revoke your billing privileges.
Deadlines That Trigger the Filing
Federal regulations set two windows. A change of ownership, any adverse legal action, or a change of practice location must reach Medicare within 30 days. All other enrollment changes — mailing address, phone number, banking information — must be reported within 90 days.1GovInfo. 42 CFR 424.516
Under a 2026 final rule, the previous 90-day window for reporting adverse legal actions was shortened to 30 days. CMS also now has authority to retroactively revoke enrollment when a provider misses the reporting deadline on a change of ownership, adverse legal action, or practice location, with the effective date set to the day after the deadline passed.
Which CMS-855 Form to Use
The right form depends on who is enrolled:
- Individual practitioners file the CMS-855I.
- Group practices and organizations file the CMS-855B.
- Changes to benefit reassignment arrangements go on the CMS-855R.
PECOS routes you to the correct application type when you log in and select “Change of Information.”2Centers for Medicare & Medicaid Services. Enrollment Applications Filing the wrong form — a CMS-855B when the situation called for a CMS-855A, for example — forces a complete restart.
Which Sections to Complete
A change-of-information filing is shorter than an initial enrollment, but certain sections must be completed every time. On the CMS-855I, sections 1, 2A, 3, and 15 are always required, plus the specific section that covers the data you are changing.3Centers for Medicare & Medicaid Services. CMS-855I Medicare Enrollment Application Updating a practice location, for instance, requires sections 1, 2A, 3, 12, 15, and whichever address subsection (2D, 2E, 4B, 4C, or 4D) applies to the location being changed.
The CMS-855B follows the same logic for group practices and organizations. The paper form must be typed; handwritten submissions are not accepted. Sign and date the certification statement, attach supporting documentation, and keep a copy.
How to Submit
You have two routes. Submit electronically through PECOS at pecos.cms.hhs.gov, or mail a paper CMS-855 to your Medicare Administrative Contractor. PECOS applications generally process faster than paper, and CMS publishes step-by-step video demonstrations for both individual providers and organizations on the PECOS welcome page.4PECOS. Welcome to the Medicare Provider Enrollment, Chain, and Ownership System
A CMS-855 filing updates your Medicare enrollment only. Your NPI record in NPPES is a separate update at nppes.cms.hhs.gov, also due within 30 days of the change.5Centers for Medicare & Medicaid Services. NPI Application/Update Form CMS-10114 If the two records disagree, Medicare will reject the CMS-855.
What to Have Ready Before You File
Most avoidable rejections come from data-entry mismatches. Gather these before you start:
- Legal name and Social Security Number, exactly as they appear in federal records.
- Your 10-digit NPI, matching what NPPES currently shows.
- Current, active state license numbers. Medicare does not accept temporary licenses, and an expired license copy will be rejected at MAC review.
- Taxonomy codes maintained by the National Uniform Claim Committee, self-selected based on your education and training.6National Uniform Claim Committee. Health Care Provider Taxonomy
- Legal business name and Employer Identification Number as they appear on your IRS CP-575 confirmation letter or quarterly tax coupon. Changing your business name or address alone does not require a new EIN.7Internal Revenue Service. When to Get a New EIN
- Full street address including suite number and ZIP code for each practice location being added, changed, or terminated.8Novitas Solutions. Enrollment Guide – Chapter 8 – Additional Enrollment Information for Part B
- Bank routing number, account number, and a voided check or bank letter on official letterhead confirming the account owner. The account holder’s name must match the Tax Identification Number on the enrollment form.
Before submitting, confirm you do not appear on the Office of Inspector General’s List of Excluded Individuals/Entities. The verification process will flag it either way, but catching it first saves weeks.9Office of Inspector General. Exclusions Program
Processing Times
CMS gives its contractors the following windows to process an enrollment application, running from the date it is received:10Palmetto GBA. Provider Enrollment Application Processing Time
- PECOS submission, no site visit needed: 15 calendar days.
- PECOS submission with site visit, development, or fingerprint required: 50 calendar days.
- Paper application, no site visit needed: 30 calendar days.
- Paper application with site visit, development, or fingerprint required: 65 calendar days.
These windows exclude “clock stoppage” time. If the MAC sends a development request for missing information, the clock stops until you respond. Monitor your PECOS account for correspondence, and respond quickly — a slow response can push a routine update past the reporting deadline.
Why Change-of-Information Filings Get Rejected
The most frequent rejection cause is a data mismatch between NPPES and PECOS: the practice address, taxonomy code, or legal business name is different between the two systems. Update NPPES first, confirm the data matches your CMS-855 entries, then submit. Other common triggers:
- Missing or invalid electronic signature. The certification was not signed by the correct Authorized Official inside the PECOS workflow.
- The wrong CMS-855 form for the enrollment type.
- Missing supporting documents, such as an IRS determination letter, a current state license copy, or DEA registration.
- TIN errors, where the Tax Identification Number does not match the legal business name in IRS records. This is common after a practice name change or entity restructuring.8Novitas Solutions. Enrollment Guide – Chapter 8 – Additional Enrollment Information for Part B
- Site visit failure, where a National Site Visit Contractor could not verify the location because it did not match PECOS records, the building appeared unoccupied, or staff denied access.
Each rejection restarts the processing clock.
What Happens If You Miss the Deadline
CMS has three escalating enforcement tools.
A stay of enrollment is the lightest response, used for minor non-compliance like a late address update. Enrollment stays active, but claims with dates of service during the stay period are rejected. A stay lasts up to 60 days. Fix the issue before it expires and those claims become eligible for resubmission and payment.11eCFR. 42 CFR 424.541
Deactivation shuts off billing privileges. Services billed during a deactivation period are not retroactively payable when you reactivate. To restore privileges you must recertify that your enrollment information is correct and furnish any missing data, and CMS can require a complete new CMS-855 application as a condition of reactivation.12eCFR. 42 CFR 424.540
Revocation is the most serious outcome. CMS can revoke enrollment for failing to comply with the reporting requirements in 42 CFR 424.516. A revoked provider faces a reenrollment bar of at least one year and up to 10 years, depending on the severity of the violation. A second revocation can carry a bar of up to 20 years, and the bar applies under any current, former, or future name, numerical identifier, or business identity.13eCFR. 42 CFR 424.535 Under the 2026 rule, revocation can be made retroactive to the day after the missed reporting deadline, exposing any payments made in the gap to recoupment.
Revalidation is a separate obligation from a change-of-information filing. Most providers and suppliers must recertify their entire enrollment record every five years, DMEPOS suppliers at least every three, and CMS can require off-cycle revalidation at any time.14eCFR. 42 CFR 424.515 Do not file a revalidation unless a due date appears for you on the Medicare Revalidation Lookup Tool at data.cms.gov/revalidation; if the tool shows “TBD,” you are not currently due. Keeping your record current with change-of-information filings between cycles makes the five-year recertification a review rather than a rebuild.