A Twelve-Month Compliance Calendar Your Practice Can Keep

Nothing in a therapy practice’s compliance life fails loudly on the day it fails. A missed license renewal does not stop Monday’s caseload. A lapsed CAQH attestation does not bounce a claim that week. A skipped exclusion-list check changes nothing visible at all. Each of these fails quietly, and the consequence arrives months later wearing a different costume: a credentialing application stalled for reasons nobody can name, a payer recoupment letter, a clinician discovering at renewal time that the continuing-education hours were never tracked.

The practices that stay out of that mess are not the ones with a compliance department — a two-person clinic will never have one. They are the ones that moved every recurring obligation out of human memory and onto a dated calendar with a named owner and a lead time. This article is the build guide for that calendar: the five cadences every obligation falls into, the specific recurring dates worth verifying for a therapy practice, and a month-by-month checklist you can copy, adjust to your own state and payers, and run once a year.

Ask an owner-clinician what went wrong after a compliance miss and the answer is almost never “we didn’t know that was required.” It is “that was the month the front desk turned over,” or “the reminder went to an inbox nobody checks.” The knowledge existed; the calendar did not. That distinction matters because it changes what the fix is. A knowledge problem calls for training. A calendar problem calls for a system — and a system is much cheaper.

What makes the calendar genuinely hard is that the obligations run on wildly different clocks, set by different authorities, with different penalties for missing them. Some examples of how different those clocks are:

A 120-day cycle, a monthly cycle, and a five-year cycle cannot live in anyone’s head at the same time — and those are only three of the clocks. The rest of this article inventories the others and then folds all of them into a single year.

Before anything goes on a calendar, sort it. Every recurring obligation a therapy practice carries falls into one of five cadences, and the sort itself does most of the organizing work: once you know an item’s cadence, you know how it should be scheduled, how much lead time it needs, and what kind of reminder actually works for it.

Notice that the failure modes differ by cadence, not by topic. Monthly items die of boredom, annual items die of deferral, multi-year items die of turnover, and event-driven items die because nobody wrote the trigger down. A calendar built cadence-by-cadence defends against each failure mode specifically.

These are the obligations that most commonly belong on a small therapy practice’s calendar, with what the governing authority actually says about each. Where a rule genuinely varies — and several do — the entry says so rather than inventing a universal number.

CAQH re-attestation: every 120 days

Most commercial payers pull credentialing data from the CAQH Provider Data Portal, and CAQH requires providers to review and re-attest their profile at least every 120 days — 180 days for Illinois providers — for the data to remain current. A lapsed attestation does not send you a bill; it silently stalls anything that reads from the profile, which is exactly the kind of failure a credentialing application discovers weeks later. Because 120 days does not divide evenly into a monthly calendar, treat it as its own repeating series per clinician, and sweep the profile’s supporting documents — license, certificate of insurance, and anything else with an expiration date — at the same time.

OIG exclusion screening: at hire, then monthly

The HHS Office of Inspector General maintains the List of Excluded Individuals/Entities (LEIE) — people and organizations barred from federal health care programs — and updates it monthly. Its 2013 Special Advisory Bulletin recommends screening employees and contractors against the LEIE at hire and monthly thereafter, because employing or contracting with an excluded person can create civil monetary penalty liability even when the work itself was fine. For a small practice the monthly check takes minutes: run every clinician, admin, biller, and contractor through the online search, and save a dated record of the result. The dated record is the point — a screening you cannot prove is a screening that did not happen.

Medicare revalidation: five years, plus 30/90-day change reporting

If the practice bills Medicare, enrollment is not a one-time event. Providers generally revalidate every five years (DMEPOS suppliers every three), CMS posts each provider’s due date roughly seven months in advance on its public Revalidation List, and the enrollment contractor sends a notice a few months before the date. Missing it can mean a hold on payment or deactivation of billing privileges. Separately — and easier to miss — federal regulation requires physicians and practitioners to report certain enrollment changes within 30 days (including a change of practice location or adverse legal action) and all other changes within 90 days. That is an event-driven obligation: it belongs in your change-of-anything checklist, not on a fixed date.

HIPAA: an ongoing risk analysis and a documented training program

Two HIPAA obligations belong on the calendar, and it is worth being precise about what the rules actually say. The Security Rule requires a documented risk analysis, and HHS guidance describes it as an ongoing process — reviewed and updated as the practice’s systems and circumstances change, not filed once and forgotten. The Privacy Rule requires training every workforce member on the practice’s policies, training new members within a reasonable period after they join, retraining anyone affected by a material policy change, and documenting all of it. Neither rule prescribes a fixed annual interval by name; the annual refresh most practices run is a convention that makes the “ongoing” and “documented” requirements easy to demonstrate. Put both on the calendar as annual items with dated artifacts — a training log with names and dates, and a risk analysis with a last-reviewed date — and the convention does the compliance work for you.

Licenses and certifications: the multi-year clocks

State license renewal is the highest-stakes date on the calendar and the least standardized: every board sets its own cycle, fee, and continuing-education requirement, so the calendar entry is not a rule — it is each clinician’s actual renewal date, looked up on the board’s site and entered with at least ninety days of lead. National certifications run on their own clocks on top of licensure. ASHA certification requires 30 professional development hours within each three-year maintenance interval, and hours beyond 30 do not carry into the next interval. NBCOT renewal runs on three-year cycles requiring 36 units, with the renewal window falling early in the calendar year. Physical therapy has no equivalent national renewal — licensure and CE rules live entirely with state boards, coordinated through FSBPT. The practical move for all of it is the same: track CE progress against the cycle at least once a year, so nobody is buying thirty hours of coursework in the final month.

Contracts, insurance, and BAAs: the dates you set yourself

The last group has no regulator behind it, which is why it gets skipped. Payer contracts carry term dates, auto-renewal clauses, and notice windows for renegotiation — miss the window and the current rates renew themselves for another term. The office lease and any equipment or software contracts work the same way. Malpractice and business policies renew on dates the carrier sets. And every vendor that touches protected health information needs a current business associate agreement, which is easy to verify once a year and unpleasant to reconstruct after an incident. None of these have a universal date, so the calendar entry is a review slot: once a year, list the contracts, confirm the dates, and move any approaching notice window onto the calendar as its own item.

Here is the whole year on one page. The two standing items run on their own cycles regardless of month; everything else is assigned a month-slot. The specific months are suggestions built around natural rhythms — certification renewals early in the year, contract reviews before year-end — so shift any slot that collides with your busy season. What must not change is that every item has a month, an owner, and a place to leave evidence.

The calendar above is a template; your practice’s version has real dates and real names in it. Building that version is a one-time job that fits in half a day, and it is worth doing as a single sitting — a calendar built in fragments over a month develops exactly the gaps it exists to prevent.

1. 01

   List every obligation you actually carry

   Start from this article’s checklist, then cut what does not apply and add what does. No Medicare billing means no revalidation entry; an all-cash practice still keeps HIPAA, licensure, insurance, and exclusion screening. The output is a flat list, one line per obligation.

2. 02

   Attach the real date and authority to each line

   Look up each clinician’s actual license expiration on the board site, each CAQH attestation cycle, each policy renewal date, each contract term. Record the date and where you found it. Any line whose date you cannot verify gets flagged, not guessed.

3. 03

   Name one owner and one backup per line

   An owner is a person, not a role — “front desk” stops meaning anything the day that person leaves. The backup exists for exactly that day. In a solo practice the owner column is boring and that is fine; the backup column is still worth filling with your biller, bookkeeper, or spouse-with-a-checklist.

4. 04

   Enter everything at its lead date with the due date in the title

   Ninety days of lead for anything involving a board, payer, or carrier; thirty for internal items. Use a shared calendar the whole practice can see, not a personal one — visibility is what lets the backup notice a missed item while it still matters.

5. 05

   Create the evidence folder before the first item fires

   One shared folder, one subfolder per year, one file per completed item: the training log, the dated screening results, the attestation confirmations, the reviewed risk analysis. Ninety seconds of filing per item builds the audit trail as a side effect of doing the work.

There is a second payoff hiding in the evidence folder. When a payer, a board, or a HIPAA investigator asks about your compliance posture, the question is rarely “did you know the rule” — it is “show me.” Show me the training log. Show me the risk analysis and when it was last reviewed. Show me that you screen your staff. A practice that runs this calendar answers every one of those questions by opening a folder, because the dated artifact was created the day the calendar item was closed. That is the quiet difference between being compliant and being able to demonstrate it — and only the second one helps you during a review.