How often does CAQH require re-attestation?

The current CAQH Provider Data Portal guide says generally every 120 days, with a 180-day exception for Illinois providers in that guide. Check the live portal/current guide because CAQH can update workflows.

Does attesting automatically update expired documents?

No. Profile fields and supporting documents still need to be current. CAQH can flag missing or expired documents, and the provider may need to update data before attesting. A good maintenance check opens the document list before attestation and resolves each dated exception first.

Why does payer authorization matter in CAQH?

A provider controls which participating organizations can access the profile. If a payer or delegated organization is not authorized, a complete profile may still be unavailable to that organization. Authorization should be checked as part of payer follow-up rather than assumed from a prior enrollment cycle.

Is CAQH the same as Medicare PECOS?

No. CAQH is a provider data-sharing platform used by participating organizations; PECOS is CMS’s Medicare provider enrollment system. Data may overlap, but the systems and decisions are different. Maintain separate status fields because completion in one platform does not establish completion in the other.

Keeping a CAQH ProView Profile Clean

The product many employers still call CAQH ProView is now the DataSpring | CAQH Provider Data Portal after CAQH’s June 2026 rebrand. The provider record is still a living data source used by authorized participating organizations, not a form you complete once and forget. It contains identity, practice, education/training, license, malpractice, disclosure, and other professional information plus supporting documents. Enrollment teams often depend on it, so stale data can turn into payer development requests or long follow-up cycles. The practical job is to keep the profile internally consistent, keep documents current, re-attest on the required cadence, and authorize the right organizations to receive the data.

Re-attestation has a real clock

CAQH’s current Provider Data Portal guide states that re-attestation is generally required every 120 days, with an Illinois exception of 180 days in the cited guide. That is a current first-party instruction and should still be checked in the live portal because workflows can change. Do not treat the attestation date as the only maintenance event. A license or malpractice certificate can expire between attestations, and a provider can change practice location, phone, hospital affiliation, or other information at any time.

CAQH maintenance board

Item	Control
Attestation	next due date + reminder before portal deadline
State license	expiration date + new verification/document when renewed
DEA / state controlled-substance credential where applicable	expiration + scope/location considerations
Malpractice insurance	policy dates + current certificate
Board certification	status/expiration where applicable
Practice locations	address, phone, hours, accepting-patient status as required
Payer authorization	which organizations can access current profile

Uploaded document and profile field must agree

A common failure is renewing a license or malpractice policy but leaving the old expiration date in the profile—or updating the field without replacing the expired supporting document. Review both the structured profile and document tab. When the portal flags a missing or expired item, fix the source data rather than repeatedly re-attesting around the error. Keep the new certificate in the organization’s credentialing file as well, because CAQH is a shared data tool, not necessarily the only record the employer must maintain.

Authorization is part of the workflow

Providers control which participating organizations can access their data through CAQH authorization settings. A complete profile does not help a payer that is not authorized to view it. When an enrollment application says it relies on CAQH, verify the provider’s authorization and the payer’s exact instructions. Do not assume that selecting one insurer name automatically authorizes every subsidiary, product, or delegated organization.

Use a change log for provider edits

When a provider changes practice location, employment, malpractice carrier, name, taxonomy, or other information, record what changed, who supplied it, the effective date, which systems were updated, and which payers or credentialing bodies need separate notification. CAQH can be one destination among many. A good change log prevents the classic situation where NPPES, CAQH, a payer portal, and the internal credentialing file all show different addresses.

Do not wait for the payer to discover the expiration

Build reminders around the item’s real renewal process. A 90-day notice may make sense for a license or insurance document that takes time to renew; a 30-day confirmation catches anything still unresolved. The exact cadence should reflect the item and organization. The reminder cadence should leave enough time for the provider to act and for updated evidence to reach every required system before expiration, without generating meaningless reminder noise.

What a new credentialing employee should audit

Take one provider and compare the internal file, CAQH, NPPES, current licenses, malpractice certificate, and two active payer records. List every mismatch without changing anything first. Then identify which source is authoritative and which downstream records must be updated. That exercise teaches more about provider data quality than simply clicking through a CAQH checklist, because it reveals how one provider identity exists across multiple administrative systems.

Use the portal’s reminder cadence as the backstop, not the team’s first alert

The June 2026 DataSpring provider guide says the portal sends ordinary practitioners re-attestation reminder emails 15, 10, and 5 days before expiration, with different timing for Illinois practitioners. Those system emails are a backstop. A credentialing team should usually create an earlier internal task when provider action, document renewal, or manager follow-up may take time. Track the primary contact email as part of the control too; an automated reminder is useless when it goes to a former employee or an inbox nobody monitors.

Build the internal task around unresolved work rather than around a ceremonial click. The record should show who owns the provider login, last attestation date, expiring documents, missing profile sections, payer authorizations, and open discrepancies. When the reminder fires, the assignee should be able to see whether the profile is already ready to attest or whether another person must supply evidence first. That turns the periodic deadline into a small queue with owners and next actions instead of a recurring emergency.

Treat mismatched dates as an investigation, not a clerical typo

If the CAQH profile lists one malpractice expiration date while the uploaded certificate shows another, do not simply choose the later date. Confirm the current policy with the provider or authoritative document, update both the structured field and attachment, and note the change. The same principle applies to practice addresses, hospital affiliations, licenses, and work history. Payers use the profile as credentialing data; a mismatch can trigger a request for clarification even when every individual field looks plausible.