CAQH Re-Attestation Every 120 Days: What Lapses in January If You Miss It

Reviewed November 5, 2026

CAQH attestation is the provider’s confirmation, every 120 days (180 in Illinois), that the CAQH Provider Data Portal profile is still accurate. Miss the date and the profile flips to “Expired” the next day, and every health plan you have authorized loses a current record to credential from. The reminders go only to the email addresses on file.

One naming note first. CAQH rebranded as DataSpring, powered by CAQH, on 7 June 2026. The provider-facing tool keeps the name CAQH Provider Data Portal (CAQH’s 2015 quick-reference guide calls it CAQH ProView; the 2023 user guide already uses the current name), and DataSpring’s clinician Q&A says no action is needed: logins, account details, profiles and saved links did not change. Nothing about the 120-day cycle changed either.

The 120-day rule, from CAQH’s own documents

CAQH’s Provider User Guide (version 43, 22 August 2023) states the rule in one sentence: re-attestation is required every 120 days, or every 180 days for Illinois providers, “to ensure your data is maintained and accurate for health plan use.” The 2015 Provider Quick Reference Guide says the same thing, and DataSpring’s 2026 clinician page still describes profiles as “maintained on a 120-day attestation cycle.”

The same user guide sets out what happens around the due date:

• Reminder emails go to the primary contact email, plus up to two additional email contacts if they are on file, at 15 and 10 days before expiration and once more shortly before it. Timing differs for Illinois.
• If no re-attestation has occurred, the provider is placed in “Expired” status the day after the attestation was due.
• Expired providers get further notices the day after expiry, then at 14, 28 and 42 days, the last of which is the final notice.

Two other points from the guide matter more than the reminder schedule. First, attestation is not only a calendar event: any change to profile data puts a reminder bar across every page until you attest again, because authorized organizations see updated data only after it has been attested. Second, the portal header shows “[number of days] until your next attestation” and the last-attested date, so the due date is never a mystery to anyone who logs in. The risk is that nobody logs in.

Why January is where it breaks

Count backwards. A profile attested in the first half of September comes due in the first half of January. One attested in late September comes due in late January. The 15-day reminder for an early-January due date lands in mid-December, the later reminders fall in the holiday weeks, and the profile expires while the office is closed or short-staffed. The final notice arrives in February.

Three things compound it at year end:

Expired documents block attestation. The user guide is explicit: if the professional liability insurance or state licence record has expired, you are prompted to update the expiration date and related details before you can attest. A provider whose policy renewed on 1 January cannot attest until the new face sheet details are entered, and the guide adds that a renewed policy must be renewed in the portal record first, or an emailed or mailed copy is rejected.

Signed forms have their own 120-day clock. The authorization, attestation and release form, and any other signed supporting document, must be uploaded within 120 days of the signature date; older signatures are not accepted (user guide, section 6.2). A form signed in September for an application that stalled over the holidays can be out of date by the time someone uploads it.

The contact email belongs to someone who left. The guide says the reminder emails go to the primary method-of-contact email in the Personal Information section. If that address was the credentialing coordinator who left in October, every pre-expiry reminder and all four expiry notices go nowhere.

What actually lapses

Be precise about this, because the consequence is indirect. An expired CAQH attestation does not itself reject a claim. What it does is remove the one record every plan you have authorized relies on.

CAQH’s own guidance (24 June 2020) puts it plainly: re-attesting “ensures every participating plan can access and use the most up-to-date information for claims payment and online directories,” and plans are encouraged to remind providers “whose credentials are about to expire—or have expired already” to re-attest. CAQH’s quick-reference guide adds that once your application is complete and documents are reviewed, your information is available to the organizations you authorized, and you must check with each organization to determine your credentialing status.

So the lapse lands in three places:

1. Initial credentialing in progress. A plan pulling a new provider’s application finds an expired profile and waits. The start date slips, and so does the first billable visit. Our post on CAQH profile mistakes that delay credentialing covers the other errors that produce the same delay.
2. Recredentialing. Plans re-verify enrolled providers on their own cycles. An expired attestation at the moment a plan runs its recredentialing pull is a missing document, with whatever follow-up that plan’s policy requires.
3. Directories. The guide tracks a separate confirmation date for each practice location, and flags a location “Attest to Confirm” when a name or specialty changes. Expired profiles mean stale directory listings.

What a given plan does with an expired profile is that plan’s credentialing policy, not CAQH’s. What you control is whether there is anything current for them to pull.

A 120-day calendar that survives the holidays

1. List every provider’s last-attested date now. It is in the portal header. Anything attested between late July and late September comes due between Thanksgiving and the end of January.
2. Set your own reminder at 30 days. CAQH’s first email is at 15 days. An internal reminder two weeks earlier gives time to chase a licence or policy renewal before it blocks attestation.
3. Make the primary contact a shared practice mailbox and use the two additional email slots for named staff. The guide allows all three and copies the additional contacts on every system message.
4. Check expiration dates in the profile before December: professional liability insurance, state licence, DEA, and any document the Documents section shows as expiring before the next attestation date. The guide shows a tooltip for policies expected to expire before the next attestation.
5. Attest after every change, not only on the cycle. A new location, a new NPI reassignment or a name change is invisible to plans until you attest.
6. Use the Practice Manager module if you manage more than a few providers. The guide describes entering shared data (practice location, liability insurance, credentialing contact) once and exporting it to each provider’s profile for import.
7. Illinois practices run on 180 days, and the guide says reminder timing differs there. Do not apply a 120-day calendar across a multi-state group.
8. Put CAQH on the same calendar as Medicare revalidation and licence renewals. Our credentialing maintenance page lists the other recurring dates, and our resources library has more credentialing references.

CAQH says re-attesting takes minutes. A lapsed one can stall credentialing at the point in the year when the front desk is also re-verifying every plan change. If you would rather hand the calendar to someone whose job is to watch it, our credentialing services team maintains CAQH profiles, document expirations and attestation dates for every provider in the group.