Provider Enrollment Guide
Multi-state Medicaid provider enrollment verification — aggregates TMHP PEMS, CAQH ProView, CA PAVE, FL FMMIS, and NY eMedNY into a single enrollment status per provider. Includes enrollment-gate integration for claims adjudication and revalidation risk detection.
Overview
The ProviderEnrollmentService consolidates enrollment status data from state Medicaid portals and national credentialing databases into a unified view. Before a claim reaches adjudication, the Enrollment Gate verifies that the rendering provider holds an active enrollment in the claim’s state — stopping unenrolled-provider claims before they incur processing cost.
State Sources
Direct integration with TMHP PEMS (TX), CAQH ProView (national), CA PAVE, FL FMMIS, and NY eMedNY enrollment portals.
Multi-State Aggregator
First-non-empty-wins resolution across all configured sources. Returns the best available enrollment status per NPI + state.
Enrollment Gate
Pre-adjudication check that blocks or flags claims from providers without active enrollment in the rendering state.
Revalidation Alerts
Proactive detection of upcoming revalidation deadlines with configurable 30/60/90-day advance warning windows.
State Enrollment Sources
Each state source is implemented as a dedicated adapter that normalizes enrollment responses into a common EnrollmentRecord model. The platform ships with five production adapters:
| Source | State | Protocol | Key Fields |
|---|---|---|---|
| TMHP PEMS | Texas | REST API | NPI, TPI, enrollment status, LOB (STAR, STAR+PLUS, STAR Kids, CHIP), effective/end dates |
| CAQH ProView | National | REST API | NPI, Organization ID, attestation status, roster status, last attestation date |
| CA PAVE | California | REST API | NPI, Medi-Cal provider ID, enrollment status, specialty, effective date |
| FL FMMIS | Florida | REST API | NPI, Medicaid provider ID, enrollment status, revalidation due date |
| NY eMedNY | New York | REST API | NPI, MMIS provider ID, enrollment status, service category, effective date |
IEnrollmentSource interface and registering in DI. The aggregator automatically picks up new sources.
Multi-State Aggregator
The MultiStateEnrollmentAggregator queries all configured sources in parallel and returns the first non-empty result set per NPI + state combination. This “first-non-empty-wins” strategy provides resilience — if the primary source (e.g., TMHP) is down, the aggregator falls through to CAQH ProView or other configured sources.
Resolution Pipeline
- Parallel dispatch — All registered
IEnrollmentSourceimplementations are queried concurrently for the given NPI and state. - Result ranking — Sources are evaluated in priority order (state-specific sources first, then national).
- First-non-empty wins — The first source returning a non-empty enrollment record set is used as the canonical response.
- Cache write-through — The resolved result is written to Redis with a configurable TTL (default: 1 hour) to avoid redundant portal queries.
Supported Lines of Business
Texas Medicaid enrollment records include LOB classification. The aggregator maps TMHP LOB codes to individual enum values:
STAR— Medicaid managed careSTARPlusPlus— Acute care + long-term services (adults with disabilities, age 65+)STARKids— Children with disabilitiesCHIP— Children’s Health Insurance ProgramDentalMaintenanceOrganization— Dental managed care
Enrollment Gate
The StateEnrollmentGate runs as a pre-adjudication middleware in the claims pipeline. For every inbound claim, the gate:
- Extracts the rendering provider NPI and service state from the claim.
- Resolves the tenant ID (from
HttpContext.Items["TenantId"]or the authorization token). - Calls the aggregator to retrieve enrollment status.
- Returns Pass if the provider has an active enrollment, or Fail with a reason code if enrollment is inactive, expired, or not found.
PassthroughEnrollmentGate that allows all claims. This enables incremental rollout — configure enrollment checking per-tenant as sources are onboarded.
Gate Response Codes
| Code | Meaning | Claim Action |
|---|---|---|
PASS |
Active enrollment confirmed | Continue to adjudication |
ENROLLMENT_INACTIVE |
Provider enrollment is inactive or terminated | Pend for review |
ENROLLMENT_EXPIRED |
Enrollment expired before date of service | Pend for review |
ENROLLMENT_NOT_FOUND |
No enrollment record found for NPI + state | Pend for manual verification |
SOURCE_UNAVAILABLE |
All enrollment sources returned errors | Configurable: pend or pass-through |
Revalidation Risk Detection
Medicaid providers must revalidate their enrollment periodically (typically every 3–5 years depending on state and risk tier). The ProviderEnrollmentService detects upcoming revalidation deadlines and generates alerts:
- 90-day warning — Early notice for providers approaching revalidation. Surfaced in the Sentinel Portal provider dashboard.
- 60-day warning — Elevated urgency. Triggers notification to the provider relations team.
- 30-day warning — Critical. Provider flagged in claims pipeline with soft-hold for manual review.
- Past-due — Revalidation deadline missed. Enrollment gate may pend new claims pending confirmation.
Caching & Performance
Enrollment lookups are cached in Redis to minimize latency and reduce load on external state portals:
- Cache key:
enrollment:{tenantId}:{npi}:{state} - Default TTL: 1 hour (configurable per tenant)
- Null handling: If a cached value deserializes to
null(e.g., due to a JSON parsing error), the cache entry is treated as a miss and the source is re-queried. - Throughput: Sub-millisecond cache hits support high-volume claims processing without bottlenecking on external APIs.
Tenant Configuration
Provider enrollment is configured per-tenant via the standard Cloud Health Office configuration system. Key settings are bound via .NET options pattern:
| Config Key | Description | Default |
|---|---|---|
ProviderEnrollment:EnabledStates |
Array of state codes to activate enrollment checking for | [] (disabled) |
ProviderEnrollment:TmhpPems:BaseUrl |
TMHP PEMS API base URL | — |
ProviderEnrollment:TmhpPems:ApiKey |
TMHP API key (stored in Azure Key Vault) | — |
ProviderEnrollment:CaqhProView:BaseUrl |
CAQH ProView API base URL | — |
ProviderEnrollment:CaqhProView:OrganizationId |
CAQH-assigned organization identifier for your health plan | — |
ProviderEnrollment:CacheTtlMinutes |
Redis cache TTL for enrollment lookups | 60 |
ProviderEnrollment:GateMode |
enforce (pend on failure) or audit (log only) |
audit |
populate-keyvault-secrets.sh script. See the Deployment Guide for Key Vault configuration.
Getting Started
- Enable enrollment checking — Set
ProviderEnrollment:EnabledStatesto the states you operate in (e.g.,["TX", "CA", "FL"]). - Configure source credentials — Add API keys for each state source to Azure Key Vault.
- Set gate mode — Start with
auditmode to observe enrollment check results without blocking claims. Switch toenforceafter validation. - Verify via portal — Use the Sentinel Portal provider enrollment dashboard to confirm enrollment statuses are loading correctly.
- Monitor — Check the
/healthendpoint for enrollment source connectivity status.
Related Documentation
Provider Verification
NPPES, OIG/LEIE, PECOS, and composite integrity scoring for provider network management.
View guide →Claims Adjudication
End-to-end claims pipeline including pre-adjudication gates and enrollment validation.
View guide →Prior Authorization
PriorAuthRuleEngine, gold card exemptions, and state-specific decision rules.
View guide →Deployment
Azure Key Vault secrets, Kubernetes configuration, and environment setup.
View guide →