What is provider credentialing?
Provider credentialing is the formal, evidence-based process of confirming that a healthcare provider is who they claim to be and holds the qualifications required to deliver care. Before a hospital, health system, or health plan permits a physician, nurse practitioner, or other clinician to treat patients or bill for services, it gathers and independently verifies details such as medical education, postgraduate training, state licensure, board certification, work history, and malpractice or disciplinary history. The defining feature of the process is primary source verification — confirming each qualification directly with the authority that issued it.
Updated 6 min read
Reviewed by Anwaar Tayyab
Director of Billing Operations ·
On this page
Key takeaways
- Credentialing verifies a provider's qualifications through primary source verification before participation or practice is granted.
- It is distinct from privileging (facility-specific clinical permissions) and from enrollment and contracting (joining a payer network to bill).
- Reviews commonly follow standards such as NCQA's and, for Medicare, CMS enrollment rules, but the specific requirements vary by payer, plan, state, and program and change over time.
- Credentialing is periodic: providers are typically re-verified on a recurring cycle, and Medicare requires revalidation.
- The effective date established through credentialing and enrollment governs when a provider may bill under a given payer.
What credentialing is
Credentialing is the structured way an organization satisfies itself that a provider's professional qualifications are genuine, current, and free of disqualifying history. Rather than relying on copies of diplomas or licenses that a provider supplies, the reviewing organization contacts the issuing sources — a medical school, a state licensing board, a specialty certifying body — and confirms each credential directly. That independent confirmation is what separates credentialing from simply collecting a folder of documents, and it is why the process is governed by recognized standards rather than left to individual judgment.
Credentialing is carried out by the entities that bear responsibility for a provider's participation: hospitals and health systems that grant access to their medical staff, and health plans that admit providers to their networks. Some delegate the verification work to a credentials verification organization (CVO), but the underlying obligation to confirm qualifications remains the same.
Credentialing is not the same as being able to bill
What gets verified
Although the exact data set is defined by each organization's policy and by standards such as those published by the National Committee for Quality Assurance (NCQA), most credentialing reviews examine a common core of elements.
- Identity and the provider's National Provider Identifier (NPI)
- Medical or professional education and completed postgraduate training
- Current state licensure and, where applicable, federal DEA registration
- Board certification and specialty status
- Work history, with an accounting of any gaps
- Malpractice claims history and professional liability coverage
- Any history of sanctions, exclusions, or disciplinary action, including screening against federal exclusion lists
Each element is confirmed through primary source verification wherever a primary source exists. Which items are required, how far back the history must reach, and which databases are queried vary by payer, by state, and by the standards an organization follows — and these requirements change over time, so the current source should always be consulted. Organizations assemble the confirmed results into a credentialing file that documents what was checked and when.
How the process works
Credentialing follows a broadly consistent sequence, even though the systems, forms, and turnaround differ from one organization or payer to the next.
Assemble the provider's information
Providers commonly maintain a CAQH profile that stores credentialing data in one place, which organizations draw on to build their own file. Keeping the CAQH profile complete and attested reduces friction later.Submit the application
The provider or a delegate submits an application to each hospital, health system, or payer and authorizes it to verify the information provided.Perform primary source verification
The organization confirms each qualification directly with its issuing source and screens exclusion and sanction databases, documenting the results.Review and render a decision
A credentialing committee or medical staff body reviews the verified file and makes a decision. Payers apply their own review criteria, set by policy and contract.Establish the effective date
Once approved, an effective date is set that governs when the provider may practice at a facility or bill under a payer's contract. How that date is determined is itself payer-specific; see effective dates.
How long each stage takes depends on the payer, the completeness of the file, and the responsiveness of verification sources. Timelines are not fixed and should be planned deliberately rather than assumed — a point developed further in credentialing timelines and planning.
Credentialing, privileging, and enrollment
Credentialing is frequently confused with two adjacent processes it enables: privileging and enrollment. They are sequential and complementary, not interchangeable. Credentialing establishes that a provider is qualified; privileging defines what they may do at a specific facility; enrollment and contracting establish that a payer will recognize and reimburse them.
| Dimension | Credentialing | Privileging | Enrollment and contracting |
|---|---|---|---|
| What it establishes | That a provider's qualifications are genuine and current | Which specific procedures or services a provider may perform at a facility | That a provider may participate in a payer's network and bill under a contract |
| Who typically performs it | Hospitals, health systems, health plans, or a delegated CVO | The facility's medical staff office and governing body | The payer, responding to an enrollment application or contract request |
| Primary input | Verified education, licensure, board status, and history | Credentialed qualifications plus facility-specific competency evidence | Credentialing results, the provider's NPI, and a signed agreement |
| Typical output | A verified credentialing decision | A defined scope of clinical privileges | A participation status and an effective date for billing |
Roles and sequencing vary by organization; some payers fold credentialing verification into their own enrollment review.
Why credentialing matters and how it is maintained
Credentialing sits upstream of the revenue cycle because it conditions everything that follows. Since a payer generally recognizes a provider only from an established effective date, services delivered before that point may not be payable under the provider's own participation. That is why credentialing and enrollment are treated as prerequisites to billing rather than paperwork to finish later, and why payer contracting is coordinated with them.
Credentialing is also not a one-time event. Organizations periodically repeat verification through recredentialing, and Medicare separately requires providers to resubmit and recertify their enrollment information on a recurring cycle in order to maintain billing privileges — a renewal of the Medicare enrollment record held in PECOS. Maintaining current information — licenses, certifications, and attestations — is an ongoing responsibility rather than a task that ends at approval. The cadence and mechanics are covered in revalidation and recredentialing and, for Medicare specifically, in Medicare enrollment with PECOS.
Requirements vary and change
Common questions
Is credentialing the same as enrollment?
No. Credentialing verifies that a provider's qualifications are genuine and current. Enrollment and contracting are the separate steps through which a payer admits the provider to its network and agrees to reimburse them. Credentialing usually precedes and supports enrollment, but they are distinct processes with different owners and outcomes.
Does completing credentialing let a provider bill a payer?
Not by itself. Being credentialed confirms qualifications, but the ability to bill a specific payer depends on enrollment or contracting with that payer and on the effective date that is established. Services provided before that effective date may not be payable under the provider's own participation.
How long does credentialing take?
It varies. Turnaround depends on the payer or facility, how complete and accurate the submitted file is, and how quickly verification sources respond. Because there is no single fixed timeline, credentialing is best planned in advance rather than assumed to finish by a particular date.
How often must credentialing be repeated?
Credentialing is periodic rather than permanent. Organizations typically recredential providers on a recurring cycle, and Medicare requires providers to revalidate their enrollment periodically. The exact intervals and triggers vary by payer, program, and standard, and can change, so the current requirements should be confirmed.
Who performs credentialing?
Hospitals, health systems, and health plans perform credentialing for the providers who participate with them. Some organizations delegate the verification work to a credentials verification organization (CVO), but responsibility for the credentialing decision remains with the participating entity.
Key terms in this article
Defined once, on their own pages.
Continue learning
Where to go next in the credentialing and enrollment cluster.
Credentialing vs. privileging
How verifying qualifications differs from granting facility-specific clinical permissions.
Primary source verification explained
Why credentialing confirms each qualification directly with its issuing source.
The CAQH profile
The centralized profile many providers maintain to streamline credentialing.
Credentialing vs. Enrollment
How credentialing relates to joining a payer network and being able to bill.
Revalidation and recredentialing
The recurring cycles that keep credentialing and enrollment current.
Corrections
The article expanded CVO as "credentialing verification organization" in the opening section and in the final FAQ answer. The term of art is credentials verification organization — the name NCQA gives the organizations it certifies to verify practitioner credentials. Both instances now use it. The maintenance section also said Medicare requires providers to revalidate their enrollment "through PECOS," which states the channel too narrowly: 42 CFR 424.515 requires a provider to resubmit and recertify the accuracy of its enrollment information to maintain billing privileges, and CMS describes PECOS as the most efficient way to submit that renewal rather than the only one. The sentence now tracks the regulation and treats PECOS as where the Medicare enrollment record is held.
Authoritative sources
- 42 CFR 422.204 — Provider selection and credentialing (opens in a new tab)
eCFR. The federal rule requiring a Medicare Advantage organization to have written policies for selecting and evaluating providers and to follow a documented process covering, for physicians and other health care professionals, initial credentialing through a signed and attested written application, verification of licensure or certification from primary sources, disciplinary status, and eligibility for payment under Medicare, and recredentialing at least every 3 years.
- 42 CFR 424.515 — Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information (opens in a new tab)
eCFR. Conditions the maintenance of Medicare billing privileges on resubmitting and recertifying the accuracy of enrollment information on a recurring revalidation cycle, and provides that CMS contacts each provider or supplier directly when it is time to revalidate.
- 42 CFR 424.520 — Effective date of Medicare billing privileges (opens in a new tab)
eCFR. Sets by regulation when Medicare billing privileges take effect, tying the date for physicians and non-physician practitioners to the later of the filing of an enrollment application that a Medicare contractor subsequently approved or the date the provider first began furnishing services at a new practice location (424.520(d)).
- Credentialing Accreditation and Certification (opens in a new tab)
National Committee for Quality Assurance program page describing its two credentialing program tracks — one evaluating organizations that provide full-scope credentialing services including committee review, one assessing organizations that verify practitioner credentials — and stating that verification is accomplished through the primary source, a recognized source, or a contracted agent of the primary source.
- For Clinicians: the CAQH Provider Data Portal (opens in a new tab)
DataSpring, powered by CAQH — the operator of the portal — on clinicians and group administrators entering their information into the portal once and sharing it with the plans they authorize, for credentialing, enrollment, and directory management.