Virginia Medicaid Provider Enrollment: PRSS, Cardinal Care Plan Credentialing, Palmetto GBA Medicare and Virginia's Credentialing Law

These are separate files. The middle column names who decides; the right-hand columns repeat only what Virginia or CMS has written down, which in several rows is nothing.

The Virginia Board of Medicine, part of the Department of Health Professions, licenses doctors of medicine, osteopathic medicine, podiatry and chiropractic and runs a public license lookup (dhp.virginia.gov). PRSS asks for proof of an active license, and since July 2025 the license date drives the enrollment itself, as explained below.

Start at the PRSS Provider Enrollment home page; the DMAS enrollment and revalidation page sends both new applicants and revalidating providers there, and the MES provider site links to the same place. DMAS's Practitioner manual, Chapter II (revised July 17, 2025) lists what the application has to carry:

1. A participation agreement for your provider type. DMAS defines a participating provider as one with a current signed agreement. For a group, hospital or agency, the authorized agent signs, and DMAS needs prior written confirmation of who that representative is.
2. An NPI from NPPES. MES uses the NPI to manage your record across every function, and the same number goes on every claim to DMAS.
3. Proof of an active license from the licensing authority for your profession.
4. Passing the screening for your risk level (limited, moderate or high; see the next section).
5. Claim documentation, if you practice out of state. A provider outside Virginia but within 50 miles of the border may enroll if every other requirement is met, but must send DMAS claim documentation during enrollment, and an out-of-state primary address needs a site visit by that state's Medicaid program or CMS before DMAS will finish.

The manual lists the grounds for denial plainly: not sending requested information, a felony conviction, a health care fraud conviction, or past actions against a license, privileges, board certification or program participation that suggest a risk to Medicaid members. A denial notice explains how to appeal.

The effective date rule matters for cash flow. Enrollment begins on the first day of the month in which DMAS receives your application. Submitting on October 31 rather than November 1 is worth a month of billable visits, and a retroactive date is approved only for documented extenuating circumstances.

Ordering, referring and prescribing (ORP) providers enroll too. Citing 42 CFR 455.410(b), the manual requires every practitioner who orders, refers or prescribes under the State plan to be enrolled, so that the billing provider's claim can pay; the ORP NPI goes on the claim. The one exception it names is a physician ordering or referring for a member in a risk-based managed care plan.

Questions about an application go to Gainwell's Provider Enrollment Services: 1-888-829-5373 toll free, 1-804-270-5105 local, or VAMedicaidProviderEnrollment@gainwelltechnologies.com.

Virginia makes PRSS mandatory even for practices that will never bill DMAS directly. The DMAS managed care network providers page explains that the federal 21st Century Cures Act requires Virginia to enroll and periodically revalidate every provider, including MCO in-network providers, and states that "MCOs are prohibited from contracting with providers who do not enroll and revalidate as required in PRSS."

The DMAS bulletin effective July 1, 2025 spells out what has to line up for any claim to pay, through fee-for-service or a plan:

• enrollment current and active for every service location and provider type;
• services billed matching the provider type and specialty enrolled in PRSS;
• license or certification active in PRSS for that type and specialty;
• services billed as rendered, under the rendering provider's NPI;
• billing, rendering, servicing, ordering, referring and prescribing providers all meeting the claim requirements.

The bulletin's own words: "MCOs and DMAS are prohibited from paying claims to network providers who are not enrolled in PRSS in the correct provider type and specialty." A practice that adds a second office and enrolls only the first location has a payment problem at the second, even with every plan contract signed. The MES MCO Provider Network Resources page says the same: a provider with several NPIs or service locations has to enroll or revalidate all of them.

Virginia screens on the federal three-tier model in 42 CFR 455 Subpart E, and the Practitioner manual describes each tier:

• Limited: DMAS verifies that you meet the federal and state rules for your provider type, that your license is valid, and that you are not excluded from federal programs, using database checks before and after enrollment.
• Moderate: all of that plus unannounced site visits, before and/or after enrollment, at initial enrollment and again at revalidation.
• High: all of the above, and owners, authorized or delegated officials and managing employees may have to undergo criminal background checks and submit fingerprints.

Screening does not stop at approval. The manual says DMAS runs an abbreviated screening every month on every participating provider and the full screening again at revalidation, so an exclusion, a license action or an NPPES change can surface mid-enrollment.

Application fee. Per the manual, the federally required fee applies to institutional providers, at initial enrollment, re-enrollment, reactivation and when adding locations, and the application or revalidation notice tells you whether you owe it. CMS sets the amount each year. You do not pay DMAS if you already paid it to Medicare or another state's Medicaid program, or if Medicare granted a hardship exception; if CMS denies a hardship request filed with the application, you have 30 calendar days from the CMS notice to pay or the application is rejected. Individual physicians and other practitioners are not institutional providers.

This is the Virginia rule most practices learned about from a denied claim. Until mid-2025, DMAS gave a provider 90 days after a license expired before terminating the enrollment agreement. The bulletin (last updated June 23, 2025) ended that on July 1, 2025, saying the grace period "causes a delay in providers having the appropriate enrollment and consequently, claims are affected by this delay."

What replaced it:

• DMAS sends courtesy notices 90, 60 and 30 days before a license expires.
• A new or returning provider is enrolled in PRSS "based on the month they apply or request reinstatement after any lapse."
• So a license renewed on the board's site but not updated in PRSS can leave a gap in which neither DMAS nor any Cardinal Care plan may pay.

The practical habit: when the board renews the license, update it in PRSS the same week, and keep the board's lookup page printout with the file.

PRSS approval does not make you a participating provider with any plan. The Practitioner manual says most Medicaid and FAMIS members are enrolled with a DMAS-contracted MCO, and that to see them a provider "must also become a participating provider in the MCO's network." The DMAS network page says the same: contact each plan and satisfy its contracting and credentialing requirements.

Per the DMAS press release of July 1, 2025, Cardinal Care Managed Care launched that day with five plans serving about 1.4 million Virginians:

Contacts are from the MES MCO Provider Network Resources page, read October 23, 2026. Molina Complete Care, which appears in DMAS's June 2025 contact list, is not one of the five plans named for July 1, 2025, so older Virginia guides that list it are out of date.

Two Virginia specifics. First, some services are carved out of managed care and paid by DMAS fee-for-service regardless of the member's plan (the manual names the developmental disability waiver services), so PRSS enrollment is what pays those. Second, none of the five plans' published timelines were found on the pages we read; the statutory 60-day clock below is the only number that applies across them.

Virginia is one of the states that put plan credentialing on a statutory clock. Va. Code § 38.2-3407.10:1 sets four deadlines for carriers:

1. Receipt. A carrier with an online system must confirm through it that you submitted and attested; otherwise it must notify you by mail or email within 10 days of receiving the application.
2. Completeness. Beginning January 1, 2024, an application is deemed complete 30 days after the carrier receives it unless the carrier has told you it is incomplete.
3. Decision. The carrier must approve or deny within 60 days of receiving a completed application.
4. Payment for the pending window. Where a contract exists with the applicant or the group that employs or engages them, covered claims for services provided while the application was pending must be adjudicated and paid within 40 days after the applicant is credentialed and contracted, at the in-network rate the provider would have received had they been credentialed on the date of service.

Three limits come with it. The section excludes Medicare Advantage coverage. It does include health maintenance organizations that issue Title XIX (Medicaid) coverage, which is how it reaches the Cardinal Care plans. And before treating a patient, the applicant must give written or electronic notice that a credentialing application has been submitted; patients then owe only their cost sharing when the claim pays. Track the pending-window visits from the day you submit, so the 40-day payment obligation has claims to attach to.

DMAS requires fee-for-service and MCO network providers to "revalidate enrollment at least every five years," electronically in PRSS (DMAS). The notice cadence:

• A DMAS notice at least 90 days before your enrollment period ends, by the method you chose at enrollment (email or USPS).
• Reminder emails 60 and 30 days out from appshcproductNoReply@gainwelltechnologies.com. Add that address to your contacts so it does not go to spam.
• No submission by the due date: participation ends in fee-for-service and every MCO network until you enroll or revalidate.

The full screening for your risk level is repeated at revalidation. If you are enrolled in Medicare at the time, the manual says DMAS may rely on the screening CMS already did. The PRSS portal's Manage Revalidation panel lists the application tracking numbers for revalidations in process and includes a password reset link.

Virginia gives you three ways to confirm where you stand:

• Gainwell, for an application in process: 1-888-829-5373 or VAMedicaidProviderEnrollment@gainwelltechnologies.com. Keep your submission confirmation, because the month DMAS received the application sets your effective date.
• The PRSS portal, once enrolled: after approval you create a PRSS account to revalidate, update information and check member eligibility, and the portal shows your revalidation date.
• The Provider Extract spreadsheet: the MES MCO Provider Network Resources page posts a file that "lists all active, enrolled Virginia Medicaid providers, revalidation dates and zip codes," refreshed at the start of each work week. Search it for every NPI and every service location ZIP. If one is missing, the plans cannot pay for it. Dental providers are not in it.

For the national picture of how status checks work in other states, see our Medicaid provider enrollment hub.

Palmetto GBA is Virginia's A/B Medicare Administrative Contractor. CMS's Jurisdiction M page (formerly Jurisdiction 11) says JM "processes FFS Medicare Part A and Part B claims for North Carolina, South Carolina, Virginia, and West Virginia." The same page's earlier fact sheets note that for Part B, JM excluded Arlington County, Fairfax County and the City of Alexandria, so a northern Virginia practice should confirm which contractor PECOS routes its application to before assuming Palmetto.

The filing itself is national: CMS-855I for an individual, CMS-855B for a group, reassignment on the 855I, all in PECOS. CMS holds every MAC to the same processing table in its Program Integrity Manual, chapter 10:

Retroactive billing is narrow: 42 CFR 424.521 lets physicians and non-physician practitioners bill up to 30 days before the effective date (90 days after a Presidentially declared disaster) when circumstances prevented enrolling first. Our Medicare provider enrollment page covers forms, PECOS and revalidation in full.

Railroad Medicare. Railroad Retirement Board beneficiaries' Part B claims go to Palmetto GBA's Railroad Medicare contractor, which needs its own PTAN. Palmetto's Enroll in Railroad Medicare page (published January 13, 2026) says to finish local Part B enrollment first, then use the PTAN Lookup and Request Tool; no second CMS-855 is filed, the Railroad PTAN shares the Part B effective date, and Palmetto asks you to allow up to 30 days. Railroad EDI enrollment is a separate step.

Virginia's commercial carriers mostly take the CAQH ProView profile as the application, and the 10/30/60-day clock in § 38.2-3407.10:1 runs from what they receive. Two things keep that clock moving: a CAQH attestation that has not lapsed (CAQH asks providers to re-attest every 120 days, per its quick reference), and a practice address, NPI and tax ID that match across CAQH, PRSS and NPPES. Our CAQH explained page walks through the profile, and the payer-by-payer credentialing hub covers each national plan's own join-the-network steps.

If you are not sure which of these files actually lets you bill, our explainer on what provider credentialing is separates credentialing, enrollment and contracting.

In our experience the delay is usually in the data the provider sends, not in the agency. Virginia's rules make each mismatch expensive, because PRSS enrollment gates every plan's payment:

• A second location never enrolled. Every NPI and service location must be in PRSS; the plan contract alone does not pay for an unenrolled site.
• Wrong provider type or specialty. DMAS and the plans may not pay services that do not match the PRSS type and specialty.
• A renewed license never updated in PRSS. With the grace period gone, the lapse starts on the expiration date.
• An ordering provider who is not enrolled. The billing provider's claim fails on the ORP's NPI.
• Revalidation emails filtered as spam. Missing the due date ends participation in every network at once.
• Addresses that disagree across PRSS, NPPES, CAQH and the board record.
• Lapsed documents such as a malpractice certificate expiring while a plan file waits.
• No Railroad PTAN, discovered when the first railroad retiree's claim rejects.

Our process is built for that: one file checked field by field against PRSS, NPPES, the Board of Medicine and CAQH before anything is submitted, then weekly follow-up with each plan and Gainwell, with the representative's name, the date and the reference number logged.

Every Virginia file above draws on the same set: individual and group NPIs with current NPPES addresses, the IRS letter showing the legal name and tax ID, the Virginia license and its expiration date, DEA and CLIA where they apply, board certification if any, the malpractice certificate, ownership and managing-employee details for the disclosure screens, every service location, bank information for payment, a current CAQH profile, and the Medicare approval letter once Palmetto issues it. The full list and the secure way to send it are on what we need from you to start credentialing.

Other state guides: Florida, Kentucky and North Carolina, which shares Palmetto GBA as its Medicare contractor.

ClaimCarePro handles Virginia Medicaid enrollment in PRSS, the five Cardinal Care plans, Palmetto GBA Medicare, the Railroad Medicare PTAN, CAQH and the commercial carriers as one checked file, followed up weekly and logged. Flat pricing: $250 per payer application per provider, CAQH setup $250, re-credentialing $250, maintenance $99 per provider per year, or the new-practice bundle at $1,750 per provider ($1,400 each additional provider on the same group and payers). Start credentialing now and get a secure start link within one business hour, or call (844) 772-8902. Service details are on provider credentialing services, and keeping enrollments current is covered on recredentialing.

Updated October 23, 2026. Each source was read on October 23, 2026 unless noted. Where a source changes, the source wins over this guide. Summaries of statutes and manuals are not legal advice.

• DMAS, Provider Enrollment & Revalidation: dmas.virginia.gov (PRSS; revalidate at least every five years; 90-day notice, 60/30-day reminders; termination if missed; Manage Revalidation panel)
• DMAS, Managed Care Network Providers: dmas.virginia.gov (PRSS launched April 2022; Gainwell vendor; Cures Act; MCOs may not contract with non-enrolled providers; dentists via DentaQuest)
• DMAS MES, MCO Provider Network Resources: vamedicaid.dmas.virginia.gov (plan contacts; Gainwell contacts; Provider Extract spreadsheet updated each work week; most recent item dated October 22, 2026)
• DMAS, Practitioner Provider Manual, Chapter II, Provider Participation Requirements (revision date July 17, 2025): vamedicaid.dmas.virginia.gov
• DMAS bulletin, Updated Provider Enrollment Requirements, Effective July 1, 2025 (last updated June 23, 2025): vamedicaid.dmas.virginia.gov
• DMAS press release, Virginia Medicaid Launches Cardinal Care Health Plans and Member Options (July 1, 2025): dmas.virginia.gov
• PRSS Provider Enrollment home page: virginia.hppcloud.com
• Code of Virginia § 38.2-3407.10:1, credentialing of providers: law.lis.virginia.gov
• CMS, Archives: A/B MAC Jurisdiction 11 (now known as Jurisdiction M) (page last modified July 8, 2026): cms.gov
• CMS, Medicare Program Integrity Manual, chapter 10 (read October 23, 2026 for our Medicare enrollment page): cms.gov
• 42 CFR 424.521, eCFR (read October 23, 2026 for our Medicare enrollment page): ecfr.gov
• Palmetto GBA, Enroll in Railroad Medicare (published January 13, 2026; read October 23, 2026 for our Medicare enrollment page): palmettogba.com
• Virginia Board of Medicine, Department of Health Professions: dhp.virginia.gov
• CAQH ProView Provider Quick Reference (read October 16, 2026 for our CAQH page): caqh.org

Not found, and therefore not stated: a DMAS processing time for PRSS applications, a public PRSS screen for looking up a new application by tracking number, a published credentialing timeline from any Cardinal Care plan, and which contractor currently processes Part B for Arlington, Fairfax and Alexandria.