Baa contract: Healthcare Contract Compliance Clocks
The Healthcare Contract Compliance Clocks carries 14 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.
Medcontra sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
- 1030 to 40
- 40 to 50
- 50 to 60
- 60 to 70
- 70 to 80
- 480 to 90
Bands
| Bucket | Value |
|---|---|
| 30 to 40 | 10 sources |
| 40 to 50 | 0 sources |
| 50 to 60 | 0 sources |
| 60 to 70 | 0 sources |
| 70 to 80 | 0 sources |
| 80 to 90 | 4 sources |
5 of the 19 named sources read in full publish a figure; 14 publish none, read 17 October 2026.
By obligation
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| obligationHIPAA substitute notice web posting | 90day | 90 to 90day | 1 |
| obligationHIPAA substitute notice toll-free line | 90day | 90 to 90day | 1 |
| obligationMedicare enrolment application fee | 750USD | 750 to 750USD | 2 |
| obligationenrolment fee non-payment notice | 30day | 30 to 30day | 1 |
| obligationMedicare participation election window | 90day | 90 to 90day | 1 |
| obligationnon-participating limiting charge | 115% | 115 to 115% | 1 |
| obligationMAC information request response | 30day | 30 to 30day | 1 |
| obligationphysician change of ownership reporting | 30day | 30 to 30day | 1 |
| obligationDMEPOS change reporting | 30day | 30 to 30day | 2 |
| obligationIDTF change reporting | 30day | 30 to 30day | 1 |
| obligationMDPP change of ownership reporting | 30day | 30 to 30day | 1 |
| obligationMedicare revalidation cycle change notice | 90day | 90 to 90day | 1 |
| obligationDMEPOS liability insurance minimum | 300,000USD | 300,000 to 300,000USD | 1 |
| obligationDMEPOS reaccreditation | 12month | 12 to 12month | 1 |
| obligationDMEPOS minimum opening hours | 30hour | 30 to 30hour | 1 |
| obligationDMEPOS surety payment on CMS notice | 30day | 30 to 30day | 1 |
| obligationDMEPOS surety bond cancellation notice | 30day | 30 to 30day | 1 |
| obligationDMEPOS replacement surety bond | 30day | 30 to 30day | 1 |
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
The sentence each figure was read from (20)
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
(10) Has a comprehensive liability insurance policy in the amount of at least $300,000 that covers both the supplier's place of business and all customers and employees of the supplier.
- CY 2026 Medicare provider enrollment application fee (Federal Register), read 2026-10-17:
This notice announces a $750.00 calendar year (CY) 2026 ( printed page 55739)
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
The 2026 enrollment application fee is $750.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
You can’t charge patients more than the limiting charge, 115% of the Medicare Physician Fee Schedule amount
- 45 CFR 164.404 (timeliness of notification to individuals), read 2026-10-17:
(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and
- 45 CFR 164.404 (timeliness of notification to individuals), read 2026-10-17:
(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
You have 90 days after we send your initial enrollment approval letter to decide if you want to be a participating provider or supplier.
- 42 CFR 424.515 (revalidation of enrollment), read 2026-10-17:
If a change occurs, CMS notifies all affected providers and suppliers at least 90 days in advance of implementing the change.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
If you don’t pay the fee or submit a hardship exception request, your MAC will send a letter allowing you 30 days from the date of the letter to pay the fee.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
Respond to MAC information requests within 30 days.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
Physicians, NPPs, and physician and NPP organizations must report a change of ownership or control (including a change in authorized official, delegated official, or managing employee), a change in practice location, and any final adverse legal actions (like a felony or suspension of a federal or state license) within 30 days and report all other changes within 90 days.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
DMEPOS suppliers must report changes in their enrollment application information within 30 days.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
Independent diagnostic testing facilities must report changes in ownership, location, general supervision, and adverse legal actions within 30 days and report all other changes within 90 days.
- CMS Medicare Provider Enrollment (MLN9658742), read 2026-10-17:
MDPP suppliers must report changes in ownership (including the authorized official, delegated official, or managing employee), changes to the coach roster, and final adverse legal actions within 30 days and report all other changes, including changes in location, within 90 days.
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
The supplier must report to CMS any changes in information supplied on the application within 30 days of the change.);
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
(i) Except as specified in paragraph (c)(30)(ii) of this section, is open to the public a minimum of 30 hours per week.
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
(i) The bond must guarantee that the surety will, within 30 days of receiving written notice from CMS containing sufficient evidence to establish the surety's liability under the bond of unpaid claims, CMPs, or assessments, pay CMS a total of up to the full penal amount of the bond in the following amounts:
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
(i) A DMEPOS supplier may cancel its surety bond and must provide written notice at least 30 days before the effective date of the cancellation to the CMS contractor and the surety.
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
A DMEPOS supplier that obtains a replacement surety bond from a different surety to cover the remaining term of a previously obtained bond must submit the new surety bond to the CMS contractor at least 30 days prior to the expiration of the previous surety bond.
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation), read 2026-10-17:
(24) All accredited DMEPOS suppliers must be surveyed and reaccredited at least once every 12 months.
Read in full, publishes no figure
14 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- 45 CFR 164.504 (organizational requirements, business associate contracts), read 2026-10-17: read in full and no accepted figure on the page
- 45 CFR 164.410 (breach notification by a business associate), read 2026-10-17: read in full and no accepted figure on the page
- 45 CFR 164.502 (uses and disclosures, general rules), read 2026-10-03: read in full and no accepted figure on the page
- 45 CFR 164.308 (administrative safeguards), read 2026-10-17: read in full and no accepted figure on the page
- 45 CFR 160.404 (amount of a civil money penalty), read 2026-10-17: read in full and no accepted figure on the page
- 45 CFR 160.316 (refraining from intimidation or retaliation), read 2026-10-17: read in full and no accepted figure on the page
- 42 CFR 424.44 (time limits for filing claims), read 2026-10-17: read in full and no accepted figure on the page
- 42 CFR 422.204 (provider selection and credentialing, subpart E), read 2026-10-17: read in full and no accepted figure on the page
- 42 CFR 422.204 (subpart D listing), read 2026-10-17: read in full and no accepted figure on the page
- 42 CFR 455.414 (Medicaid revalidation of enrollment), read 2026-10-17: read in full and no accepted figure on the page
- CMS revalidations, read 2026-10-17: read in full and no accepted figure on the page
- CMS PECOS, read 2026-10-10: read in full and no accepted figure on the page
- HHS sample business associate agreement provisions, read 2026-09-12: read in full and no accepted figure on the page
- HHS guidance on business associates, read 2026-09-12: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
5 of the 19 named sources that could be read published a usable figure; 14 published none and are recorded as not published, never filled in; 1 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 14 figures, never sentences; 20 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per obligation: the rule, the clock, the citation and the effective date, quoted verbatim from the CFR or the agency - BAA required provisions (45 CFR 164.504(e)), business-associate breach notice to the covered entity (60 days, 164.410(b)) beside the covered entity's own notice duty (164.404), the HIPAA penalty tiers (160.404), Medicare revalidation (424.515) and its DMEPOS variant (424.57), Medicare Advantage credentialing and recredentialing (422.204), the Medicare claim-filing limit (424.44), Medicaid revalidation (455.414), and the enrolment application fee, which is the only number here that changes every year.
The derivation nobody publishes is the CALENDAR: every obligation on one timeline keyed to the contract type a provider actually signs, with changed-since per rule, so a contract owner sees which clock moved this year rather than reading eleven CFR parts
20 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (20)
- 45 CFR 164.504 (organizational requirements, business associate contracts)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 164.410 (breach notification by a business associate)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 164.404 (timeliness of notification to individuals)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 164.502 (uses and disclosures, general rules)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 164.308 (administrative safeguards)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 160.404 (amount of a civil money penalty)(the publisher's own terms; quoted for reporting and comment)
- 45 CFR 160.316 (refraining from intimidation or retaliation)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 424.515 (revalidation of enrollment)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 424.57 (DMEPOS supplier standards and revalidation)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 424.44 (time limits for filing claims)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 422.204 (provider selection and credentialing, subpart E)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 422.204 (subpart D listing)(the publisher's own terms; quoted for reporting and comment)
- 42 CFR 455.414 (Medicaid revalidation of enrollment)(the publisher's own terms; quoted for reporting and comment)
- CY 2026 Medicare provider enrollment application fee (Federal Register)(the publisher's own terms; quoted for reporting and comment)
- CMS Medicare Provider Enrollment (MLN9658742)(the publisher's own terms; quoted for reporting and comment)
- CMS revalidations(the publisher's own terms; quoted for reporting and comment)
- CMS PECOS(the publisher's own terms; quoted for reporting and comment)
- HHS sample business associate agreement provisions(the publisher's own terms; quoted for reporting and comment)
- HHS guidance on business associates(the publisher's own terms; quoted for reporting and comment)
- ecfr.gov(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Healthcare Contract Compliance Clocks carries 14 published figures read from 5 sources' own pages, from 30 to 90 day, read 17 October 2026.
5 of the 19 named sources read in full publish a figure; 14 publish none, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation HIPAA substitute notice web posting: median 90 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation HIPAA substitute notice toll-free line: median 90 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation Medicare enrolment application fee: median 750 USD across 2 sources, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation enrolment fee non-payment notice: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation Medicare participation election window: median 90 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation non-participating limiting charge: median 115 percent across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation MAC information request response: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation physician change of ownership reporting: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS change reporting: median 30 day across 2 sources, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation IDTF change reporting: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation MDPP change of ownership reporting: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation Medicare revalidation cycle change notice: median 90 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS liability insurance minimum: median 300,000 USD across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS reaccreditation: median 12 month across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS minimum opening hours: median 30 hour across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS surety payment on CMS notice: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS surety bond cancellation notice: median 30 day across 1 source, read 17 October 2026.
Healthcare Contract Compliance Clocks, obligation DMEPOS replacement surety bond: median 30 day across 1 source, read 17 October 2026.
Cite as: "Medcontra Healthcare Contract Compliance Clocks", updated 2026-10-18, https://medcontra.com/datasets/healthcare-contract-compliance-clocks/.
Download the CSV (20 rows, computed 2026-10-18)