Credentialing Checklist: Initial File and Recredentialing Dates

A provider credentialing checklist has two parts. Initial credentialing collects and verifies the license, DEA registration, education, board certification, malpractice cover and history, work history and exclusion checks. Recredentialing repeats it on fixed clocks: CAQH attestation every 120 days, NCQA recredentialing every three years and Medicare revalidation every five years.

You are onboarding a new clinician, or a payer has just asked for a recredentialing packet you did not know was due. The documents live in five places and every clock runs on a different cycle. This checklist lists every item, cites the rule behind each date and shows you how to track them in a spreadsheet this week.

Key takeaways

• Credentialing is verification, not paperwork. NCQA describes it as review of a practitioner's "license, medical education, history of sanctions, prior malpractice cases and other information" before they join a network.
• Plan for 90 to 180 days. MGMA puts the time between application and approval at 90 to 180 days, so start before the provider's first day.
• CAQH is now DataSpring. Profiles in the CAQH Provider Data Portal are kept on a 120-day attestation cycle.
• NCQA requires recredentialing every three years for the organizations it accredits; many payers use the same cycle.
• Medicare revalidation is every 5 years. You have 60 days to respond once CMS contacts you, and CMS does not grant extensions.
• Hospitals must query the NPDB (National Practitioner Data Bank) at appointment and every 2 years.
• Small changes have short deadlines. Medicare wants a new practice location reported within 30 days, and NPI record changes are due within 30 days.

One credentialing file, then five clocks that run on different cycles (rules checked 12 October 2026).

What goes on a provider credentialing checklist?

A provider credentialing checklist lists every document a payer, hospital or your own committee will verify, with the source used to verify it. Collect these before you submit anything. Payers and hospitals add their own forms, so treat this as the core file, not the whole of every application.

Payer applications are only half the job. If you also grant privileges or employ the provider, your own medical staff or credentialing committee needs the same file. Our guide to provider credentialing explains how credentialing, privileging and payer enrollment fit together.

What are the steps in initial credentialing?

Initial credentialing runs in seven steps, and the clock starts when the file is complete, not when you first ask for it. MGMA puts the time between application and approval at 90 to 180 days, so the steps below are worth starting before the offer letter is signed.

1. Collect the file. Send the checklist above to the provider on day one and set a return date. Missing items are the usual cause of delay.
2. Update the CAQH profile. The provider completes and attests the DataSpring profile, then authorizes each payer to view it.
3. Run primary source verification. Check each license, DEA registration, board status and education with the issuing body, and save a dated screenshot or letter.
4. Run the background checks. Query the NPDB and the LEIE, and note the date of each search on the file.
5. Committee review. Your credentialing committee or medical director signs off, with the date recorded.
6. Enroll with payers. Submit Medicare through PECOS and each commercial application. Log the submission date and reference number for each payer.
7. Confirm effective dates. Record each payer's effective date before the provider sees that payer's patients. Medicare allows retrospective billing of up to 30 days before the effective date only "if circumstances precluded enrollment in advance" (42 CFR 424.521).

How often is recredentialing required?

Recredentialing is not one date. Each body sets its own cycle, so a provider can be current with one payer and overdue with another. The table compiles the cycles we verified from the official sources, with the rule behind each.

The five recurring credentialing clocks on one scale, from the sources in the table above.

Licenses are the exception: renewal cycles and continuing education rules are set by each state board. Look them up on the board's own site and copy the expiry date from the license itself. For controlled substances, see how long a DEA registration lasts.

What does a recredentialing checklist include?

A recredentialing checklist re-verifies everything that can change and confirms nothing new has happened. You do not re-verify a diploma, but you do re-verify every license, registration, certificate and claim.

Malpractice cover deserves its own record. A claims-made policy that ends without tail cover can leave a gap that shows up at the next recredentialing; our guide to malpractice insurance tracking covers what to log.

What happens if you miss a credentialing deadline?

Do this now: a credentialing tracker in one afternoon

You can set up a working tracker in a spreadsheet today. Use one row per provider per state, because licenses and DEA registrations are state by state. These columns and formulas work in Excel, Google Sheets and LibreOffice.

Format columns B to L as dates and sort by column L every Monday. Column H uses our suggestion of a 120-day start; that is planning advice, not a rule. Medicare revalidation is copied rather than calculated because CMS sets the due date, and posts it seven months ahead.

Time estimates for a 2-hour first pass (about 20 providers): 30 minutes to list providers and states, 45 minutes to copy license, DEA and CAQH dates from the online lookups, 30 minutes to add committee and NPDB dates from the files, and 15 minutes to sort and flag anything due within 90 days. These are our estimates; your first pass may take longer if files are scattered.

How can you make credentialing faster next time?

• Pick one attestation day a month. Ask every provider to re-attest CAQH on the same day so 120-day cycles never drift into a busy week.
• Keep a verification log. Save each primary source check as a dated PDF named provider-item-date. Recredentialing then starts from last cycle's evidence.
• Ask for expiring documents before they expire. Request the new malpractice certificate 30 days before renewal, not after.
• Track payer effective dates separately from approval dates. A signed contract is not the same as being able to bill.
• Review the tracker monthly with the practice manager. New hires, new locations and departures are what break credentialing; catch them while the 30-day Medicare clock is still running.

Practices credentialing dentists and hygienists have a few extra steps; see our dental credentialing checklist.

Spreadsheet or software for credentialing?

A spreadsheet works when one person runs credentialing for a small group, in one or two states, and checks it every week. Researcher Raymond Panko reviewed audits of business spreadsheets and found "errors in 94% of the spreadsheets studied" (Panko), so test your date formulas each quarter. A spreadsheet also cannot remind anyone; someone has to open it.

A tracking tool earns its place when you have several states, many payers or more than one person sharing the work. ExpiryEdge keeps each credential as a record with an owner and a backup, sends reminders at 90, 60, 30 and 7 days by email, SMS, Slack or Teams, and can send providers a document request link for renewed certificates. It does not do primary source verification or payer enrollment; a credentials verification organization (CVO) or your own team still does that.

Frequently asked questions

What documents are on a provider credentialing checklist?

The core file is a CV, every state license, DEA and state controlled substance registrations, board certification, education and training certificates, malpractice certificate and claims history, hospital privileges, NPI, an attested CAQH profile, exclusion checks, an NPDB query and each payer's application. Payers and hospitals may add their own forms.

How long does provider credentialing take?

MGMA puts the time between application and approval at 90 to 180 days. The clock effectively starts when the file is complete, so collecting documents on day one is the biggest time saver.

How often is recredentialing required?

NCQA requires recredentialing every three years for the organizations it accredits, and many payers use the same cycle. Separately, CAQH profiles are attested every 120 days, Medicare revalidation is every five years and hospitals query the NPDB every two years.

How often do providers attest in CAQH?

Every 120 days. CAQH is now called DataSpring, and it says clinician profiles in the CAQH Provider Data Portal are maintained on a 120-day attestation cycle. Track the last attestation date and add 120 days.

How do I know when Medicare revalidation is due?

Search the Medicare Revalidation List on the CMS website. CMS posts due dates seven months in advance and contacts each provider when it is time; you then have 60 days to submit (42 CFR 424.515). CMS does not grant extensions.

Can a provider see patients before credentialing is complete?

They can, but a payer may not pay for those visits until the provider's effective date. Medicare allows retrospective billing of up to 30 days before the effective date only if circumstances prevented enrollment in advance. Check each commercial payer's contract.

Sources

• NCQA, NCQA's credentialing standards ensure safety and integrity of practitioner networks (19 Nov 2024; accessed 12 Oct 2026).
• DataSpring, Clinicians and office staff and CAQH Provider Data dental FAQs (accessed 12 Oct 2026).
• eCFR, 42 CFR 424.515, 424.516, 424.521 and 424.540 (up to date as of 8 Oct 2026).
• CMS, Revalidations (renewing your enrollment) (accessed 12 Oct 2026).
• eCFR, 45 CFR 60.17 and NPDB, Hospitals (accessed 12 Oct 2026).
• eCFR, 45 CFR 162.410 (NPI updates).
• eCFR, 21 CFR 1301.13 and DEA Diversion Control, Registration FAQ.
• eCFR, 42 CFR 482.22 and 42 CFR 1001.1901; HHS-OIG, Exclusions.
• Blue Cross Blue Shield of Michigan, Credentialing and recredentialing (accessed 12 Oct 2026).
• MGMA, Navigating the credentialing gauntlet.
• Raymond R. Panko, What We Don't Know About Spreadsheet Errors Today.
• Last reviewed: 12 October 2026