Medicaid Revalidation 2026: What Behavioral Health Providers Must Do

CMS just told all 50 states to re-screen every Medicaid provider — fast. Here’s what clinicians need to know, what’s already happening in some states, and how to get ahead of it.

Medicaid revalidation 2026 is now a national priority. On April 23, 2026, CMS Administrator Dr. Mehmet Oz sent letters to every governor and state Medicaid director in the country directing them to “swiftly revalidate” Medicaid providers — particularly those the state designates as “high-risk” — as part of the federal effort to reduce fraud, waste, abuse, and “corruption” in the program. States have ten business days to respond on whether they’ll comply and on what timeline. They have thirty days to submit a comprehensive two-year revalidation strategy.

This is national. It applies to all 50 states (and presumably DC). It will affect a meaningful number of behavioral health providers — including some who probably aren’t expecting it.

If you bill Medicaid in any capacity — directly, through supervised billing, as a group practice, or as a contractor on a Medicaid waiver — this is worth understanding now rather than discovering when your revalidation notice arrives. Even cash-pay practices need to be concerned with compliance.

What Revalidation Actually Is

Federal regulations have required Medicaid provider revalidation since 2011. Every Medicaid-enrolled provider — institutional or individual — has to be re-screened at least every five years. Some categories revalidate every three years.

Revalidation isn’t just paperwork. It includes verification of your professional license, a check against federal exclusion databases (the OIG’s List of Excluded Individuals/Entities and similar), and depending on your assigned risk level, can also include unannounced site visits, fingerprinting, and criminal background checks.

CMS classifies providers into three risk tiers:

Limited risk — License verification and federal database screening. Most outpatient mental health professionals fall here.

Moderate risk — Limited screening plus an on-site visit, announced or unannounced.

High risk — Limited and moderate screening plus fingerprints and criminal background checks for owners and key personnel.

States designate which providers fall in which tier. There’s some flexibility, but certain providers must be classified as high-risk by federal rule — for example, when a credible fraud allegation has triggered a payment suspension.

Revalidation is not the change, but how it is implemented is certainly changing, alongside other major federal compliance updates.

What Changed on April 23

Two things.

First, CMS is asking states to revalidate high-risk providers off-cycle, more often than the standard five-year window. The agency wants states to “prioritize high-risk providers who have not been screened within the past 12 months for near-term revalidation.” For the first time, revalidation isn’t just a recurring administrative cycle — it’s a near-term sweep.

Second, and more significantly: CMS is pressuring states to expand their definition of “high-risk.” The letter to governors states explicitly that CMS expects each state’s high-risk definition to “include any provider without a National Provider Identifier.”

This is the line that matters for behavioral health.

Who Doesn’t Have an NPI

Most licensed clinicians have one. If you’re an LCSW, LICSW, LMHC, LPC, LMFT, psychologist, psychiatrist, or APRN billing for individual services, you almost certainly have an NPI and have been using it on every claim you submit.

But not everyone in the Medicaid behavioral health workforce has one. Examples:

Pre-licensed and supervisee clinicians — In some states, pre-licensed clinicians historically billed under a supervisor’s NPI rather than obtaining their own. Vermont changed this with HCAR 9.103 in October 2025, requiring all supervisees to enroll directly with Medicaid. Other states still allow various supervisor-billing arrangements where the supervisee may not have an NPI on record.

Personal Care Attendants (PCAs) and other non-medical home and community-based services workers. CMS doesn’t require PCAs to have NPIs, and many states don’t either. Under the new federal expectation, these workers may now be subject to high-risk screening — fingerprints, criminal background checks, in-person verification.

Peer support specialists and community health workers — Some states require NPIs for these roles, others don’t. In states where they don’t, those workers are now potentially classified high-risk under the federal expectation.

Recovery coaches, family support providers, and various Medicaid waiver service providers — Coverage and NPI requirements vary widely by state and waiver.

If your practice or organization employs or contracts with anyone in these categories, those workers may face a more burdensome revalidation process — which means more administrative cost, more delay, and in some cases, real workforce disruption.

What’s Already Happening

Minnesota is the precedent everyone is watching. After CMS accused the state of paying $243.8 million to potentially fraudulent providers in 2025, Minnesota’s Medicaid agency negotiated a Corrective Action Plan that includes off-cycle revalidation for providers in 13 service areas — largely home care services and non-medical transportation. Approximately 5,800 providers are subject to in-person visits, fingerprint background studies for individuals with controlling interests, and credential verification. Notices went out in late January with a target completion date of May 31. Staff from across state government were reassigned to handle the load.

Other states already in CMS’s crosshairs include the nine that received the March 2026 congressional letter on Medicaid fraud vulnerabilities — Vermont among them. Vermont’s Agency of Human Services confirmed last week it’s still assessing how to respond to the new CMS request.

Beyond Vermont and Minnesota, states with large home and community-based services populations, large pre-licensed workforces, or recent fraud cases will likely see the most aggressive activity. That includes states with significant rural Medicaid populations and states that have invested heavily in workforce expansion through peer support and community health worker models.

What Behavioral Health Providers Should Do Now

Confirm your enrollment is current. Log into your state Medicaid provider portal and verify that your enrollment information — address, license, DEA if applicable, contact email — is correct. Outdated contact information is one of the most common reasons providers miss revalidation notices.

Make sure everyone in your organization has an NPI if eligible. If you employ or contract with pre-licensed clinicians, peer specialists, or other Medicaid-billable staff who don’t have NPIs, work with them to obtain one. The NPI application is free and processed by CMS within a few business days. Even if your state doesn’t currently require it, having one in hand removes a likely source of “high-risk” classification.

Know your state’s revalidation cycle and current status. Each state Medicaid program publishes revalidation schedules and provider notices. If you’re enrolled, you should know when you’re due.

For supervisees and pre-licensed staff: get them properly enrolled. Vermont providers recently dealt with a major shift in how enrollment was managed. Other states are at varying stages of implementing similar requirements. If your state still permits supervisor-only billing, expect that to change.

Tighten your documentation. The revalidation process verifies that information you’ve submitted to the Medicaid agency is accurate. Make sure your group practice’s roster, ownership disclosures, NPI assignments, and tax information are clean and up to date. If you’ve added or removed providers, ownership has changed, or you’ve moved offices, those updates need to be in the system.

For high-risk providers: prepare for fingerprinting and background checks. If your state classifies any of your work as high-risk, owners and key personnel will need fingerprint background checks. Get this scheduled proactively rather than scrambling when a notice arrives.

Pay attention to your state Medicaid director’s communications. With states racing to respond to a 30-day federal deadline, expect rapid policy guidance, provider portal updates, and emergency rule changes. Don’t rely on annual newsletters — sign up for real-time provider bulletins and email alerts from your state Medicaid agency.

A Note on the Bigger Picture

Reducing actual fraud against Medicaid is a legitimate goal. Bad actors do exist, and keeping them out of the program is exactly what provider screening is for. The Georgetown Center for Children and Families notes that if CMS’s framing holds — partnership with states, focused on bad actor providers rather than enrollees — it represents a productive direction.

The risk for behavioral health is collateral damage. Aggressive blanket reclassification of NPI-less providers as high-risk, on a compressed federal timeline, can pull workers out of the field who were never the problem — particularly in home and community-based services, peer support, and pre-licensed pipelines that already operate with thin margins and chronic workforce shortages.

Provider participation in Medicaid is already fragile in many states. Adding administrative burden and screening costs without commensurate rate increases tends to push providers — especially small practices and individual contractors — out of the program rather than catching fraud.

That’s not an argument against revalidation. It’s an argument for paying attention, getting ahead of the requirements, and being clear-eyed about the difference between fraud prevention and access reduction.

The Bottom Line

CMS is moving fast, and so are states. If you bill Medicaid — directly or through any arrangement — you should:

Verify your enrollment information is current
Confirm every billable provider in your organization has an NPI
Watch your state Medicaid provider bulletins closely over the next 60–90 days
Prepare for off-cycle revalidation if you do high-risk work or employ NPI-less providers
Expect timelines, requirements, and definitions to keep shifting

This is one of the most consequential federal actions on Medicaid in years. Behavioral health providers who pay attention will navigate it. Those who don’t may discover their enrollment status is in jeopardy when they have a claim denied or a payment suspended.

The Wellness Collaborative offers resources, tools, and community for mental health and wellness professionals. Explore our membership to access guides, trainings, and more.

This post is for informational purposes only and does not constitute legal or compliance advice. Medicaid policy varies by state and is changing rapidly. Consult your state Medicaid agency, professional association, and where appropriate, a healthcare attorney for guidance specific to your situation.