Provider credentialing: the process, the deadlines and how to track them
A clinician can't see patients or bill a payer until they are credentialed, and the clock doesn't stop after approval. Attestations, recredentialing, DEA renewals and Medicare revalidation all run on different cycles. This guide explains each step, lists every recurring deadline with its official rule, and gives you a 2-hour audit you can run this week.
Provider credentialing is verifying a clinician's license, education, training, board certification, DEA registration, malpractice coverage and history before they treat patients or bill a payer, then repeating it on a cycle. MGMA puts initial approval at 90 to 180 days. After that, separate clocks run: NCQA-accredited plans recredential every three years, and DataSpring (CAQH) profiles need attesting every 120 days.
You have a new provider starting next month, two recredentialing packets due, and a payer letter you can't find. You need to know what has to happen, in what order, and which dates will catch you out. Here it is.
- MGMA reports 90 to 180 days between submitting a provider application and credential verification and approval.
- CAQH is now DataSpring; profiles in the CAQH Provider Data Portal (formerly ProView) are kept on a 120-day attestation cycle.
- NCQA requires recredentialing every three years for the health plans and organizations it accredits.
- DEA registrations renew every 36 months after the first period, and a practitioner needs a separate DEA registration in each state where they handle controlled substances.
- Medicare requires providers to revalidate enrollment every 5 years; CMS sends the notice, and you have 60 days to respond.
- Hospitals must query the National Practitioner Data Bank (NPDB) when a practitioner applies for privileges and every 2 years after.
- Credentialing (checking qualifications) and privileging (approving what a clinician may do) are separate steps with separate dates.
Why provider credentialing deadlines matter
90–180 days
from application to credential verification and approval (MGMA)
54%
of medical practices said credentialing-related denials increased in 2021 (MGMA Stat poll, n=425)
1 in 4
healthcare organizations lose as much as $1 million a year in billings to credentialing delays (Intelliworx poll, Dec 2025)
What is provider credentialing?
Provider credentialing is the process of confirming, from the original sources, that a clinician is qualified to practice: their license is active, their education and training are real, their board certification and DEA registration are current, and their malpractice and disciplinary history is acceptable. Health plans credential providers before adding them to a network. Hospitals and surgery centers credential before granting privileges. Group practices credential new hires and keep the file current for every payer they bill.
These are the credentials a credentialing file usually holds:
CE requirements change by role and state. Each board sets its own hours and audit rules, so keep the CE evidence with the license it supports.
What are the steps in the provider credentialing process?
The provider credentialing process runs in seven steps. Steps 1 to 5 happen before the first billed visit; steps 6 and 7 never stop.
Collect the application
Gather the provider's licenses, DEA and state registrations, board certificates, education and training, work history, malpractice certificate and claims history, and NPI. Most commercial payers pull this from the provider's DataSpring (CAQH) profile, so complete and attest it first.
Verify from primary sources
Confirm each item with the body that issued it: the state board for the license, the DEA for the registration, the board for certification, the school or program for training. Record who verified what, when, and how.
Check sanctions and history
Search the HHS-OIG exclusion list and, for hospitals, query the NPDB. Hospitals must query the NPDB at application and every 2 years (45 CFR 60.17).
Committee decision
The credentialing committee (or medical staff, for a hospital) reviews the file and approves, conditions or declines it.
Enroll with payers
Submit Medicare enrollment (through PECOS), Medicaid and each commercial plan. Medicare lets physicians and several other practitioner types bill retrospectively for up to 30 days before their effective date when circumstances prevented earlier enrollment (42 CFR 424.521(a)). Do not count on more.
Grant privileges (hospitals and ASCs)
Privileging decides which procedures the clinician may perform. CMS requires the medical staff to "periodically conduct appraisals of its members" (42 CFR 482.22(a)(1)); the interval is set in your bylaws. A renewed license without renewed privileges is still a gap.
Monitor and recredential
Track every expiry and cycle in the table below, attest DataSpring every 120 days, and rebuild the file before each recredentialing date.
Credentialing and privileging are not the same thing. Credentialing confirms qualifications; privileging approves what a clinician may do at a specific facility. Both have review dates. Our provider credentialing checklist breaks each step into the documents to collect, and the dental credentialing checklist covers dentists and hygienists.
Which provider credentialing deadlines recur, and how often?
Each credential has its own clock, set by a different body. This table lists the recurring deadlines a practice or credentialing team must track, with the rule behind each one.
Provider credentialing deadlines (verified 12 Oct 2026)
| Deadline | How often | Set by | Official source |
|---|---|---|---|
| DataSpring (CAQH) Provider Data Portal attestation | Every 120 days | DataSpring (formerly CAQH) | DataSpring |
| Health plan recredentialing | Every three years (NCQA-accredited organizations) | NCQA | NCQA |
| DEA practitioner registration · More | First period 28–39 months, then every 36 months; separate registration per state | DEA, 21 CFR 1301.13(d), 1301.12(a) | eCFR 1301.13 |
| Medicare enrollment revalidation | Every 5 years (DMEPOS suppliers follow separate rules); respond within 60 days of CMS's notice | CMS, 42 CFR 424.515 | eCFR 424.515 |
| Medicare changes of information | Within the time the enrollment rules set; failure is a deactivation reason | CMS, 42 CFR 424.540(a)(2) | eCFR 424.540 |
| NPDB query (hospitals) | At application for privileges and every 2 years | HHS, 45 CFR 60.17 | eCFR 60.17 |
| Medical staff appraisal / reappointment (hospitals) | "Periodically"; interval set in medical staff bylaws | CMS, 42 CFR 482.22(a)(1) | eCFR 482.22 |
| State Medicaid exclusion checks | State agencies check the LEIE and EPLS at least monthly | CMS, 42 CFR 455.436 | eCFR 455.436 |
| State professional license | Cycle and CE hours set by each state board | State licensing board | |
| Malpractice insurance | Policy term on the declarations page; note claims-made vs occurrence | Your carrier |
Do this now: a 2-hour credential-file audit (no software needed)
You can find every gap in a 20-provider practice in about two hours (an estimate; allow more for hospitals with privileging files).
Build the list (20 minutes)
One row per provider per state, with columns for each credential in the table above. The free provider credential matrix has this layout ready.
Fill dates from the source, not memory (60 minutes)
Copy each expiry from the license verification page, the DEA certificate, the board's lookup, the malpractice declarations page and the payer's last recredentialing letter. Log the last DataSpring attestation date from the portal.
Calculate the next dates (10 minutes)
Use the formulas below.
Pick three files at random (30 minutes)
Can you produce each provider's current license, DEA, board certificate, malpractice certificate and payer approvals in five minutes? Every miss is a gap to fix before a payer or surveyor asks.
Spreadsheet date maths (Excel, Google Sheets, LibreOffice):
- DataSpring next attestation:
=F2+120where F2 is the last attestation date. - Days left for any credential:
=H2-TODAY(); color red below 0, amber at 30 or less, yellow at 90 or less. - Next deadline per provider across columns H to P:
=MIN(H2:P2). - Which credential that is:
=INDEX($H$1:$P$1,MATCH(MIN(H2:P2),H2:P2,0)).
Worked example: a last attestation on 1 September 2026 gives =DATE(2026,9,1)+120 = 30 December 2026. On 12 October 2026 that is 79 days away, so it shows yellow.
How do you make credentialing faster and less painful?
- Start 120 days before a recredentialing date. It gives one full DataSpring cycle to fix data before the payer pulls it (advice).
- Attest on a fixed day. Pick one day each month to check every provider due within 30 days.
- Track DEA per state. Telehealth and multi-site providers need one DEA row per state (21 CFR 1301.12(a)).
- Know the malpractice form. Claims-made policies need tail cover when they end; record the form on the file. See malpractice insurance tracking.
- Keep CE evidence with the license. Boards audit CE after renewal. Attach certificates to the license row.
Track the provider's next deadline, not each credential. One "next due" column (the MIN formula above) sorted soonest-first turns a 15-column sheet into a to-do list.
Spreadsheet or healthcare credentialing software?
A spreadsheet works for a small group (roughly under 15 providers in one or two states; an estimate) if one coordinator owns it and reviews it weekly. It breaks when:
- providers need their own reminders, because a sheet cannot send one;
- you must prove who verified what and when, for a payer or a survey;
- providers hold several state licenses and DEA registrations;
- the coordinator leaves and the knowledge leaves with them.
Spreadsheets also fail quietly: Panko's review of field audits found errors in 94% of business spreadsheets examined (arXiv:1602.02601).
Full credentialing platforms and credentialing verification organizations (CVOs) perform the primary-source verification for you. A tracking tool like ExpiryEdge does a narrower job: it holds every license, DEA registration, board certificate, malpractice policy and attestation as a record with an expiry date, owner, backup owner and the document attached, and sends reminders at 90, 60, 30 and 7 days by email, SMS, Slack or Teams, with an audit trail of every reminder and upload.
One record per credential
Each license, registration, certificate and policy has its own expiry date, owner and backup owner.
Reminders that reach the provider
Reminders at 90, 60, 30 and 7 days by email, SMS, Slack or Teams, to the provider, the coordinator or both.
Documents on the record
Attach the license, DEA certificate or declarations page; renewals keep the old document in the history.
Who verified what, and when
Record who verified each item, when, and the evidence, with every action timestamped.
Renewal checklists
A recredentialing or attestation task can carry its own checklist, with each step tracked.
Document requests
Ask providers to upload a renewed certificate or policy without sending files by email.
Provider credentialing guides
- Provider credentialing checklist
- Dental credentialing checklist
- Malpractice insurance tracking
- LPC license renewal requirements by state
- How long does a DEA license last?
- Free provider credential matrix
- License and permit expiration tracker
- Employee certification tracking
- Dental practice compliance
- License renewal reminder software vs a calendar
- Certification tracking software vs spreadsheets
Frequently asked questions
Provider credentialing is verifying that a clinician is qualified to practice, by checking their license, education, training, board certification, DEA registration, malpractice coverage and history with the original sources. Health plans do it before adding a provider to a network, and hospitals before granting privileges. It is repeated on a cycle, called recredentialing.
MGMA puts it at 90 to 180 days from submitting the application to verification and approval. Payers often pull application data from the DataSpring (CAQH) profile, so complete and attest it before you apply.
NCQA requires recredentialing every three years for the organizations it accredits, and many health plans follow that cycle. Medicare enrollment is revalidated every 5 years. Hospitals reappraise medical staff periodically on the schedule in their bylaws. Check each payer contract for its own cycle.
Yes. DataSpring's site says "CAQH is now DataSpring", and the provider profile is now called the CAQH Provider Data Portal (formerly ProView). Profiles are maintained on a 120-day attestation cycle, so set a reminder before each 120-day date.
Credentialing confirms a clinician's qualifications. Privileging decides which procedures or services they may perform at a specific hospital or facility, based on those qualifications. Both have review dates, and a current license does not keep expired privileges valid.
Yes, if they handle controlled substances in more than one state. DEA requires a separate registration in each state, and the practitioner must first have state authority to handle controlled substances there. Registrations renew every 36 months after the first period.
At minimum: state licenses, DEA and state controlled-substance registrations, board certification, education and training, work history, malpractice certificate and claims history, NPI, sanction and NPDB checks, payer approvals and, for hospitals, privileges. Record where and when each item was verified. The free provider credential matrix lists each one.
Sources
Last reviewed: 12 October 2026
- MGMA, Navigating the credentialing gauntlet
- MGMA Stat, credentialing-related denials (24 Aug 2021)
- Intelliworx poll on credentialing delays (Dec 2025)
- DataSpring, clinicians
- NCQA, credentialing standards (19 Nov 2024)
- DEA Diversion Control, registration FAQ
- 21 CFR 1301.13, DEA registration periods
- 42 CFR 424 subpart P, Medicare enrollment (424.515, 424.521, 424.540)
- 42 CFR 482.22, hospital medical staff
- 42 CFR 455.436, Medicaid database checks
- 45 CFR 60.17, NPDB hospital queries
- Panko, spreadsheet errors (arXiv:1602.02601)
Find credentialing gaps before a payer or a surveyor does.
Import your roster, attach each provider's documents, and get reminders at 90, 60, 30 and 7 days for every license, DEA registration, attestation and policy. Free for 14 days, no credit card.
Start tracking provider credentials free