PECOS is the online system you use to enroll in Medicare, and in 2026 it runs on PECOS 2.0 with mandatory multi-factor login through the I&A system. Enrolling comes down to six moves: get your NPI, set up I&A access, log in and pick your scenario, complete the sections and upload documents, e-sign, then submit and track. This guide walks through the PECOS system itself, the login, the navigation, the status codes, and the errors that quietly stall applications, so you get to billing privileges without the back and forth through the Medicare provider enrollment and credentialing process, helping practices avoid delays and secure approvals faster.
What is PECOS in Medicare?
PECOS stands for the Provider Enrollment, Chain, and Ownership System. It’s the CMS online portal where providers and suppliers enroll in Medicare, update their records, manage billing privileges, and complete revalidation. Every initial application, change of information, revalidation, and change of ownership flows through it. If you want to bill Medicare, PECOS is where it starts.
The current version is PECOS 2.0, the modernized platform CMS rolled out to replace the older workflow. It logs in through the Identity and Access (I&A) Management system, pulls provider data straight from NPPES, and cross references applications against IRS and federal databases as you submit. That real time checking is a double edged thing: it catches errors early, but it also means a mismatch you didn’t notice gets flagged immediately.
This guide focuses on the PECOS system specifically. If you want the broader picture of Medicare enrollment overall, including the CMS-855 forms, the 750 dollar fee, and participating status, read our companion guide on how to enroll in Medicare as a provider. (how to enroll in medicare as a provider.)
What you need before you log in to PECOS
PECOS pulls from other systems and rejects gaps, so the prep work decides how smoothly the application goes. Have these ready first.
- An active NPI from NPPES, with the name, address, and taxonomy code correct
- I&A login credentials, and for organizations, an Authorized Official designated in I&A
- Your Social Security number, date of birth, and license details
- Legal business name and Tax ID exactly as the IRS has them
- Practice location, ownership, and managing control details
- Bank account information and a voided check for EFT enrollment
- An active CAQH profile, re-attested within the last 120 days, is essential because an expired profile is one of the most common causes of delays in CAQH credentialing.
Almost every PECOS delay we see traces back to a gap in this list, not to the portal itself. PECOS works fine. The data feeding it is usually the problem.
How to enroll in PECOS Medicare, step by step
Six steps, in order, with the spot where each one tends to go wrong.
Step 1: Get your NPI through NPPES
PECOS assumes you already have an NPI, and it pulls your data directly from NPPES. So before anything else, confirm your NPI record is active and correct, the legal name, the practice address, the taxonomy code. If NPPES is wrong, PECOS will be wrong too, and the mismatch surfaces as a conflict before the application can process. NPI updates in NPPES don’t automatically flow into PECOS, so any change needs a parallel update.
Step 2: Set up I&A access with multi-factor authentication
PECOS login runs through the CMS Identity and Access (I&A) Management system. In 2026, multi-factor authentication is required for every PECOS login, so if you used to sign in with just a username and password, you have to register through I&A first. For an organization, designate an Authorized Official in I&A before you go further, because that AO controls the organization’s PECOS access and is the one who can sign. Uncoordinated account setup is a classic early stumble, get the roles straight before anyone touches the application.
Step 3: Log in to PECOS and choose your enrollment scenario
Once you’re in, PECOS asks what you’re doing: an initial enrollment, a change of information, a revalidation, or a reassignment of benefits. Pick the right one, because it determines the questions and documents that follow. PECOS uses the answers to pull the correct CMS-855 sections automatically, so you don’t choose a paper form by hand, but choosing the wrong scenario sends you down a path that doesn’t fit and creates rework.
Step 4: Complete the sections and upload documents
Work through the sections methodically: practice locations, ownership and managing control, Tax ID, and banking details for EFT enrollment through the CMS-588. One detail catches a lot of applications at final review: the legal name on your bank account has to match the IRS record exactly, including the LLC or Inc. suffix. Upload your supporting documents at submission, not after, since incomplete documentation is the leading trigger for a MAC development request.
Step 5: E-sign the certification statement
Before submission, the Authorized Official electronically signs the certification statement. The e-signature has to match that person’s I&A credentials and role. This step has a hard deadline that surprises people: if the required signatures aren’t completed within 20 calendar days, PECOS rejects the application, and a delay in signing can change the effective date of a new enrollment. Confirm the certification is done before you leave the session.
Step 6: Submit, track status, and respond to the MAC
Submit the application and your Medicare Administrative Contractor processes it. Track the status in PECOS rather than waiting in the dark, and watch every channel for MAC correspondence, including the email spam folder. If you see a Returned status or get a development request, respond within 30 calendar days, miss that window and the application can reject, forcing a restart. After approval, the same record is used for your ongoing re-credentialing services, including the five-year Medicare revalidation cycle.
Understanding PECOS application status codes
PECOS shows you where the application stands, and reading the status right tells you whether to wait or act.
| Status | What it means | What to do |
|---|---|---|
| In Process | The MAC is reviewing your application | Wait, but keep watching for correspondence |
| Development Request | The MAC needs more information | Respond within 30 calendar days, or it rejects |
| Returned | CMS found missing or incorrect information | Fix the flagged items and resubmit promptly |
| Approved | Billing privileges granted | Confirm the effective date and begin billing |
| Rejected | The application can’t proceed as filed | Identify the cause and restart cleanly |
The pattern worth internalizing: the statuses that cost you time, Returned and Development Request, almost always come from data that didn’t line up at submission. Clean input prevents most of them.
What changed in PECOS for 2026?
PECOS 2.0 brought real changes that affect how you enroll this year:
- Multi-factor authentication on every login. All PECOS access now requires I&A credentials plus MFA. Old username only logins no longer work.
- Real time data validation. PECOS 2.0 cross references your application against IRS, NPPES, and adverse action databases automatically during submission, so mismatches surface immediately.
- Cloud infrastructure. CMS migrated PECOS 2.0 to cloud hosting in 2026. Organizations that restrict access by IP allowlist need to update their network configuration so logins don’t break.
- Tighter reporting. Changes of ownership, location, and final adverse legal actions must be reported within 30 calendar days, and CMS can deactivate an enrollment after 12 months of inactivity.
None of this changes the six steps, but it raises the cost of sloppy data and idle enrollments. PECOS checks more, faster, than it used to.
The PECOS mistakes that delay enrollment most
| Mistake | What it causes | How to avoid it |
|---|---|---|
| NPPES and PECOS don’t match | Conflict flagged before processing | Align NPPES name, address, taxonomy first |
| I&A roles not set up | You can’t access or sign in PECOS | Designate the AO and roles before starting |
| Signature not completed in 20 days | Application rejects, effective date slips | E-sign immediately, confirm before leaving |
| Bank name doesn’t match IRS | Payments held even after approval | Match EFT bank name to the IRS record exactly |
| Missed development request | Rejection and a full restart | Respond within 30 days, check spam folders |
| Expired CAQH profile | Development request, delay | Re-attest within 120 days before submitting |
When to handle PECOS yourself, and when to get help
A single provider with a clean record and a simple setup can work through PECOS without much trouble, the system guides you and validates as you go. The friction shows up with scale and complexity: setting up I&A roles for an organization, getting the Authorized Official right, enrolling a group on the 855B, handling a change of ownership, or running PECOS alongside Medicaid and commercial enrollment for a multi-state practice.
That’s where a team that lives in PECOS earns its keep. We keep NPPES and PECOS aligned, set up I&A correctly the first time, e-sign on schedule, and track every application through the MAC so a development request never sits unanswered. Our provider enrollment services handle the whole PECOS filing, as part of our broader medical credentialing services.
Get Help With Your PECOS Enrollment
Frequently asked questions
What is PECOS in Medicare?
PECOS stands for the Provider Enrollment, Chain, and Ownership System. It’s the CMS online portal where providers and suppliers enroll in Medicare, update their records, manage billing privileges, and complete revalidation. PECOS 2.0 is the current modernized version, integrated with the I&A Management system for login and with NPPES for provider data. For Medicare enrollment in 2026, PECOS is the primary submission pathway.
How do I log in to PECOS in 2026?
You log in to PECOS using credentials from the CMS Identity and Access (I&A) Management system, with multi-factor authentication, which is required for all PECOS logins in 2026. If you previously used only a username and password, you have to register through I&A before you can access your enrollment records. Organizations must designate an Authorized Official in I&A first.
Do I need an NPI before I can use PECOS?
Yes. You need an active National Provider Identifier, obtained through NPPES, before enrolling in PECOS. PECOS pulls data directly from NPPES, so your name, address, and taxonomy code must match exactly. NPI updates in NPPES do not automatically sync to PECOS, and that mismatch is one of the top three causes of application rejection.
What does a Returned PECOS application status mean?
A Returned status means CMS found missing or incorrect information in your application. You have to review the CMS comments, correct the errors, and resubmit within the timeframe given. Returned and development-request statuses are the most common reasons enrollment stalls, and both trace back to incomplete or mismatched data at submission.
Who can electronically sign a PECOS application?
Only an Authorized Official or Authorized Manager assigned through I&A Management can electronically sign a PECOS application, and the e-signature must match that person’s credentials and role. PECOS rejects an application if the required signatures are not completed within 20 calendar days of submission, and a delayed signature can affect the enrollment’s effective date.
How long does PECOS enrollment take?
An accurate, complete PECOS web submission processes in about 7 days according to MAC data from Palmetto GBA, and roughly 45 days on average. Submit with missing information and the timeline jumps to about 35 days or longer, because each correction restarts the clock. Responding to any MAC development request within 30 calendar days keeps the application moving.
Want your PECOS enrollment handled start to finish?
We set up I&A, keep NPPES and PECOS aligned, complete and e-sign the application, and track it through the MAC to active billing privileges. Send us your provider list and we’ll tell you exactly where to start. Free, no commitment.
