Skip to main content

How to Create a PECOS Account

Last updated

Before you can file or manage Medicare enrollment in PECOS, you need two things:

  1. A CMS Identity & Access Management (I&A) account
  2. Your I&A account linked to your NPI or organization in PECOS

This guide walks through both steps. The account creation process takes about 20–30 minutes if you have everything ready, plus 1–3 business days for identity verification.

Before you start

Have these ready:

  • Your active National Provider Identifier (NPI) — Type 1 (individual) or Type 2 (organization)
  • Social Security Number (for individual providers) or EIN (for organizations)
  • Current email address — CMS will send verification and account management emails here
  • A working phone number (some identity verification steps require a phone call or text)
  • Current legal name exactly as it appears in your NPPES record

Step 1: Go to I&A and register

Navigate to idm.cms.gov (the CMS Identity & Access Management portal).

Click “New User Registration.”

You’ll be asked to:

  • Choose a role: “Provider/Supplier” for individual providers or organizations filing their own enrollment. “Billing Agency” if you’re a billing company or credentialing service filing on behalf of providers.
  • Enter your email address (this becomes your I&A login)
  • Create a password (meet CMS password requirements — minimum length, complexity)
  • Set up security questions

⚠️ Use an email address you control and will maintain long-term. Your I&A account is tied to this email. If you leave a practice and your email becomes inactive, recovering PECOS access for that practice is a significant process.

Step 2: Identity verification

CMS requires identity verification for I&A accounts. For individual providers:

Online verification (faster): CMS uses Experian for identity verification. You’ll be asked to answer questions about your identity (address history, financial accounts, etc.). This happens in real time during registration.

If online verification fails (it sometimes does for recent address changes or thin credit files):

Manual verification (takes 1–3 business days): You’ll receive an activation code by mail at the address associated with your I&A account. Enter the code when it arrives to complete verification.

⚠️ If your NPPES address differs from your current residence, online verification may fail. This is the most common identity verification failure point. If it happens, the mail-based verification is your fallback.

Step 3: Log in to PECOS

After I&A account creation and verification:

  1. Go to pecos.cms.hhs.gov
  2. Click “I&A User Login”
  3. Log in with your I&A credentials

First-time PECOS access: you’ll see a screen asking you to “Request Access” to a PECOS account.

For individual providers:

  1. In PECOS, click “My Associates”
  2. Select “Add a New Provider/Supplier or Organization”
  3. Enter your NPI
  4. Select your provider type
  5. Enter your legal name (must match NPPES exactly)
  6. Enter your SSN (for identity confirmation)

PECOS will search for your NPI in the system. If you’re a new enrollee who hasn’t filed yet, PECOS will confirm your NPI exists in NPPES and prepare a new enrollment record.

If you’re a returning provider who was previously enrolled and has a PTAN, enter your PTAN to link to your existing record.

For authorized officials (organizations):

  1. In PECOS, click “My Associates”
  2. Select “Add a New Provider/Supplier or Organization”
  3. Enter the organization’s Type 2 NPI
  4. Select the organization type
  5. Enter the organization’s legal name and EIN
  6. Confirm your role as authorized official

⚠️ Authorized official vs. delegated official. The authorized official is the individual with legal authority to bind the organization (CEO, president, managing partner). Delegated officials are staff members the authorized official grants PECOS access to. An authorized official must set up their access first; delegated officials are added afterward.

Step 5: Adding delegated officials (for organizations)

If you’re an authorized official and want to grant PECOS access to a practice manager, billing coordinator, or credentialing specialist:

  1. Log in with your authorized official I&A credentials
  2. Go to “My Associates”
  3. Select “Add Delegated Official”
  4. Enter the delegated official’s I&A username (they must create their own I&A account first)
  5. Select the level of access (view-only or full management)

The delegated official can then access PECOS through their own I&A login with the organization’s records visible.

⚠️ Risk flags

⚠️ One I&A account per person. CMS I&A accounts are tied to individuals, not roles. Don’t share login credentials. Each person who needs PECOS access should have their own I&A account.

⚠️ Employee turnover. When a practice manager or authorized official who has PECOS access leaves your organization, their access doesn’t automatically revoke. Remove delegated access for departing employees immediately.

⚠️ Email changes. If you change your email address, update your I&A account. An I&A account with an unmonitored email address means you’ll miss security notices, password reset options, and enrollment correspondence.

Account recovery

If you’ve lost access to your I&A account:

  • Forgot password: Use the “Forgot Password” link on idm.cms.gov
  • Locked account: Contact the CMS EDI Help Desk at 1-800-MEDICARE (1-800-633-4227)
  • Lost access to email address: This requires manual identity re-verification with CMS; contact your MAC
  • Organization authorized official left: Contact your MAC with documentation of new authorized official authority; they’ll guide the access transfer process

After account setup: next steps

Once your I&A account is created and linked to your NPI in PECOS, you’re ready to:

Having trouble with I&A account setup or PECOS access? Ask Mae →