TL;DR
Provider credentialing verifies a clinician’s qualifications and enrolls them with payers so their services can be billed. It is commonly treated as onboarding paperwork and is actually a revenue cycle control, since an uncredentialed provider cannot bill. The structural difficulty is that credentialing is not an event with a completion date. It is a state that expires continuously, across licenses, registrations, certifications, attestations, and payer revalidations that all run on different clocks.
Key Takeaways: Credentialing has two phases: primary source verification of qualifications, and enrollment with each individual payer. Commercial enrollment commonly takes three to six months, and providers cannot bill until it completes. CAQH attestation falls due every 120 days, commercial recredentialing typically runs on a three-year cycle, and Medicare revalidation on roughly five. NCQA’s 2025 standards push verification from periodic toward continuous.
What is provider credentialing?
Provider credentialing is the process of verifying that a clinician holds the qualifications, licenses, and professional history they claim, and then enrolling them with the health plans whose members they will treat.
It is frequently described as an administrative step inside onboarding, sitting somewhere between the employment contract and the first clinic day. That framing understates it considerably. Until a provider is credentialed and enrolled with a given payer, services rendered to that payer’s members are either unbillable or require retroactive filing that many payers will not honor. Credentialing therefore determines when a clinician begins generating billable encounters, which makes it a revenue cycle function that happens to be administered by operations or HR.
The financial arithmetic is straightforward and unforgiving. A physician who would generate a substantial annual professional fee volume, sitting unable to bill for several months while enrollment completes, represents a loss that cannot be recovered later. Every week of delay is permanently gone.
The two phases
Credentialing is often discussed as one process and is actually two, sequenced.
Primary source verification confirms the provider’s qualifications directly with the issuing authority rather than accepting what the provider supplied. State medical licenses are verified with the licensing board, DEA registration with the DEA, board certification with the certifying body, education with the medical school, and work history with prior employers. Sanctions and exclusion checks run against the relevant federal and state databases.
Payer enrollment applies to participate in each health plan’s network, and it is plan by plan. Each payer sets its own documentation requirements, its own forms, and its own submission channel, with some accepting CAQH data, some requiring separate applications, some operating portals, and some still accepting paper.
Both must complete before a provider can bill that payer. A practice contracting with ten to fifteen plans is therefore running ten to fifteen parallel processes with different requirements and different clocks.
CAQH ProView
CAQH ProView is the shared repository most commercial payers draw on. A provider populates one profile covering demographics, licensure, education, work history, and malpractice coverage, then authorizes plans to access it. In June 2026 CAQH rebranded as DataSpring, and ProView is now called the CAQH Provider Data Portal; the URL, logins, and profile data carried over unchanged.
Two properties matter operationally. The profile requires attestation every 120 days, and a lapsed attestation can stall enrollment or limit plan access to the data. And the profile must be consistent with other records, particularly NPPES and each payer’s own enrollment data, because credentialing systems depend on exact matching. A practice address that differs between CAQH and a payer record, or a taxonomy code that does not align with the billing system, is enough to trigger manual review and add weeks.
Timelines
Realistic expectations matter because they determine when the process must start.
Commercial payer enrollment commonly runs three to six months even with a clean application. Medicare typically takes less, on the order of two to three months. Some state Medicaid programs run considerably longer.
The practical implication is that credentialing should begin when the employment agreement is signed rather than when the provider starts, ideally several months ahead of the first clinic day. Practices that begin at onboarding have already guaranteed a revenue gap.
What changed in 2025
The most consequential recent change comes from NCQA, whose credentialing standards anchor most health plan and credentials verification programs.
NCQA’s 2025 credentialing standards, which apply to surveys from July 1, 2025, shortened the primary source verification window. For accredited organizations, verifications can now be no more than 120 days old at the time of the credentialing decision, down from 180; for certified credentials verification organizations, 90 days, down from 120. The update also introduced monthly monitoring of sanctions, exclusions, and license expirations between recredentialing cycles.
The direction is unmistakable. What was previously verified every few years is moving toward continuous review. A credentialing operation designed around a three-year recredentialing cycle is now structurally behind the standard it is being measured against.
The structural problem: credentialing never finishes
Here is the point that reframes the work, and it explains why credentialing consumes more effort than its description suggests.
Credentialing is not a task with a completion date. It is a state that expires continuously.
Look at the clocks running simultaneously for a single provider. The state medical license renews on its own cycle, and separately for every state in which they practice. DEA registration renews on another, and must match the physical practice location. Board certification has its own term. Malpractice coverage renews annually. CAQH attestation falls due every 120 days. Commercial recredentialing typically runs on a three-year cycle. Medicare revalidation runs on roughly five.
None of these align. Multiply by the number of providers in the organization and by the number of payers each is enrolled with, and the result is a population of expiry dates with no natural review point.
The failure modes follow directly, and they are all quiet. An expired license discovered during recredentialing can trigger retroactive claim recoupment for the period it lapsed. A CAQH attestation nobody completed suspends plan access to the profile. A provider who changes practice location without the payer records being updated generates claims denied as out of network. A missed Medicare revalidation removes billing privileges.
In every case the organization continues operating normally and continues billing, and discovers the problem when denials begin. The lag between the lapse and the symptom is the expensive part.
Where the work actually goes
Strip back the terminology and the work is specific and repetitive.
Someone gathers a document set for each provider: licenses, DEA registration, board certificates, malpractice face sheets, diplomas, CV, and identifiers. Someone verifies each against the issuing source rather than the copy provided. Someone completes a differently structured application for each payer, in that payer’s format, through that payer’s channel. Someone reconciles CAQH against NPPES against each payer’s record to ensure the fields match. Someone follows up on applications sitting in queues, because verification requests get lost and documents expire mid-cycle. And someone tracks every expiry date across every provider and every payer.
Almost none of this is clinical judgment or even credentialing judgment. It is document collection, cross-system comparison, and deadline tracking, performed at a volume that scales with providers multiplied by payers multiplied by credential types.
That is why the spreadsheet is always out of date. Not because nobody maintains it, but because maintaining it manually at that multiplication is not realistic.
Where automation fits
The constraint is document handling and reconciliation rather than decision-making, which is where automation changes the economics.
Automation that can read unstructured documents and reason about their contents can extract credential details from licenses, certificates, and coverage documents whatever format they arrive in, compare the same provider’s data across CAQH, NPPES, and payer records to surface the mismatches that trigger manual review, monitor expiry dates across every credential and payer relationship, and assemble payer-specific application packages from a single verified source.
The shift toward continuous monitoring makes this more consequential than it was. A monthly monitoring requirement is a significant manual burden and a modest automated one, and organizations that have not closed that gap will feel the new standards as headcount rather than as compliance.
Because credentialing determines billing eligibility and errors can trigger retroactive recoupment, every verification needs to be traceable to the source document and the date it was confirmed. A credential you cannot evidence was verified is one you will be asked to verify again.
To be clear about scope, Kognitos is not a credentialing platform or a credentials verification organization. It does not maintain payer rosters, replace a CVO, or perform the verifications that must be conducted by an accredited entity where the standard requires it. What it addresses is the document reading, cross-system reconciliation, and expiry tracking underneath, operating alongside your credentialing system and producing a record of what was checked and when.
For related processes, see our guides on healthcare automation, payer contract management, vendor onboarding automation, internal controls, master data management, and AI in healthcare. To see how deterministic AI tracks expiring credentials and reconciles provider data across systems, book a demo or try the platform.
Getting started
Two diagnostics that require no new software.
Build one complete expiry map for a single provider. List every credential, registration, certification, attestation, and payer revalidation with its due date and its owner. If assembling that takes more than an hour for one clinician, the organization does not currently have visibility into its own billing eligibility.
Reconcile CAQH against NPPES against one payer’s record for ten providers. Count the mismatches in practice location, taxonomy, and identifiers. That mismatch rate is the best available predictor of how much of your credentialing delay is self-inflicted rather than caused by payer queues.
