Provider Credentialing and Enrollment

Why it matters in numbers

Who is involved

The practitioner

Supplies the application, attestation, documents and signatures. Owns the CAQH profile and the NPPES record, even when staff maintain them. Legally responsible for the accuracy of every enrollment application filed in their name.

Credentialing specialist or medical staff office

Collects the packet, runs primary source verification, prepares the file for committee, tracks expirations. In a hospital this is the medical staff services department; in a group it is often one or two people in revenue cycle or HR.

Credentials verification organization (CVO)

A vendor, or a health system's own certified unit, that performs primary source verification once and shares it with several plans or facilities. NCQA certifies CVOs so that plans can rely on their work.

Credentialing committee

Peer clinicians who review each file and vote. Payers, hospitals and delegated groups all have one. A file is not "credentialed" until the committee (or a medical director under its delegated authority for clean files) has approved it.

Enrollment specialist

Files with Medicare (PECOS), Medicaid, each MCO and each commercial payer; follows up with the Medicare Administrative Contractor (MAC); captures effective dates and provider IDs; sets up EFT and ERA. Often the same person as the credentialing specialist in a small group.

Payers

Medicare through its MACs; state Medicaid agencies and their managed care organizations; commercial plans with their own credentialing departments or delegated arrangements; Medicare Advantage plans that must follow 42 CFR 422.204.

Primary sources

State licensing boards, the AMA Physician Masterfile, ABMS and specialty boards, medical schools and residency programs, the DEA, the NPDB, OIG's LEIE, SAM.gov, state Medicaid exclusion lists, malpractice carriers.

Billing and coding

Inherit the result: the rendering NPI, the taxonomy, the effective dates by payer, and the rules for billing a not-yet-enrolled provider's work. They are the first to see enrollment failures, as denials.

What goes wrong

Credentialing

The process of collecting and verifying at the primary source a practitioner's qualifications: identity, education, training, licensure, DEA registration, board certification, work history, malpractice history, sanctions and exclusions. The output is a verified file and a committee decision. Hospitals, health plans, delegated groups and CVOs all credential; each does it to its own standard (CMS Conditions of Participation, The Joint Commission, NCQA, URAC, state law).

Privileging

A hospital or facility decision about what a practitioner may do there: admit patients, perform specific procedures, interpret studies, use particular equipment. Granted by the governing body on the medical staff's recommendation, scoped by specialty and competence, reviewed through focused and ongoing professional practice evaluation (FPPE and OPPE), and reappraised periodically, commonly every two years.

Enrollment

Registering a practitioner or organization with a payer so that claims can be paid: Medicare through PECOS and the MAC, Medicaid through the state and its MCOs, commercial plans through CAQH and their own forms. The output is a provider record with an effective date, a billing relationship (reassignment to a group), and, for Medicare, a PTAN. Enrollment is what the claim is adjudicated against.

Contracting

The participation agreement between an organization and a plan: fee schedule, products, term, termination, timely filing, credentialing standards. A practitioner can be credentialed by a plan and still be out of network if the group has no contract for that product; a group can have a contract and still be unpaid for a practitioner who is not yet credentialed and loaded.

Loading

The payer's internal step of entering the approved practitioner into its claims system, directory and provider file with the right NPI, tax ID, locations and products. Credentialing approval and loading are often weeks apart; a claim sent between them denies as "provider not on file."

Re-credentialing, revalidation, re-attestation

The same three processes on repeat: plans and hospitals re-credential (NCQA: at least every 36 months; Medicare Advantage: at least every 3 years; hospitals commonly every 2 years); Medicare and Medicaid revalidate enrollment (every 5 years, DMEPOS every 3); CAQH asks the practitioner to re-attest every 120 days.

How they fit together for one new physician

1. 1

   Offer accepted Day −180

   Dr. Ana Rivera (fictional; NPI 1987654321) signs with Riverside Medical Group (billing NPI 1234567893, tax ID 361234567) to start on March 1. The credentialing team requests her packet the same week.

2. 2

   Packet and CAQH Day −170 to −150

   Application, CV with month-and-year history, licenses, DEA, board certificate, malpractice face sheets and claims history, references, signed attestation and release. Her CAQH profile is updated, the group is authorized to view it, and she re-attests.

3. 3

   Primary source verification Day −150 to −120

   License, DEA, board status, education and training, NPDB query, OIG and SAM screening, Medicare opt-out list, state Medicaid exclusion list, malpractice history. Every verification is dated so the plan can see it is within its time limit.

4. 4

   Medicare and Medicaid filed Day −120

   CMS-855I with reassignment to Riverside in PECOS; the MAC processes it and issues a PTAN. The state Medicaid application and each MCO's roster addition go in the same week.

5. 5

   Commercial applications Day −120 to −90

   Each plan is notified and pulls the CAQH profile. Plans that delegate credentialing to Riverside instead receive her on the next monthly roster after Riverside's own committee approves her.

6. 6

   Hospital privileges Day −120 to −30

   The hospital's medical staff office runs its own file, the department chair recommends, the credentials committee and medical executive committee review, the board approves. Temporary privileges may bridge a short gap.

7. 7

   Effective dates captured Day −30 to 0

   Each approval letter's effective date, provider ID and product list is recorded in the practice management system's provider table. Scheduling is opened only for payers that are live, or claims are held by payer.

8. 8

   First patient Day 0

   Claims go out under NPI 1987654321 rendering, 1234567893 billing. Anything still pending is held, with a 30-day Medicare retro window and whatever each commercial contract allows.

The NPI

Format

Ten digits, the last a check digit computed with the Luhn formula over the prefix 80840 plus the first nine digits. No embedded meaning; a Type 1 and a Type 2 look alike.

NPPES

The National Plan and Provider Enumeration System at nppes.cms.hhs.gov. Free, usually issues an NPI within days, and holds the public record: name, addresses, taxonomy, other identifiers. Changes must be reported within 30 days. Bulk enumeration through Electronic File Interchange (EFI) lets an employer obtain NPIs for new hires.

NPI Registry

The public lookup at npiregistry.cms.hhs.gov. Payers, clearinghouses and scrubbers validate the NPI, the entity type and the taxonomy against it. If the registry shows the wrong practice address or an old name, claims and directory listings carry the error.

NPPES does not update PECOS

Updating the NPPES record does not change Medicare enrollment. Both must be maintained. The legal business name and individual name must match across NPPES, PECOS, the IRS and the bank (for EFT).

On the claim

Billing provider NPI (loop 2010AA, box 33a), rendering provider NPI (loop 2310B, box 24J), and when relevant referring (2310A, box 17b), service facility (2310C, box 32a) and supervising provider. The payer matches each against its enrollment file; a rendering NPI that is not enrolled or not linked to the billing NPI denies.

Taxonomy codes

The Health Care Provider Taxonomy code set is maintained by the National Uniform Claim Committee (NUCC) and published at taxonomy.nucc.org, with updates twice a year. Each code is ten alphanumeric characters in three levels: provider grouping, classification and area of specialization. NPPES stores one or more per NPI and marks one primary.

The CAQH profile

What goes in it

Personal and practice information, every license and DEA registration, education and training with dates, work history with no unexplained gaps over 30 days, hospital affiliations, malpractice coverage and claims history, disclosure questions, uploaded documents, and a signed attestation.

Authorization

The practitioner (or their delegate) must authorize each plan to view the profile. "Global" authorization lets any participating plan pull it. A plan that is not authorized reports the application as incomplete and the clock does not start.

Re-attestation every 120 days

The practitioner must review and re-attest at least every 120 days (180 days for providers practicing in Illinois). A profile past its attestation date shows as expired and plans will not use it for credentialing or recredentialing. Reminders go to the email on file, which is often a former employer's.

Document expirations

Uploaded licenses, DEA certificates and malpractice face sheets expire in the portal on their own dates. A current attestation with an expired document behind it is still an incomplete file to the plan.

Practice manager module

Lets a group maintain common practice data (locations, tax ID, billing address) and push it to each practitioner's profile, which is how multi-site groups keep hundreds of profiles aligned.

Directory data

Plans increasingly feed their directories from the profile. A wrong location or an old phone number in CAQH becomes the No Surprises Act directory error that makes a patient's out-of-network claim payable at in-network cost sharing, and makes the plan come back to the provider.

What is verified, and where

NCQA's rules on timing

The credentials file, in order

• Signed, dated application and attestation Within the plan's limit (commonly 120 to 180 days) on the decision date; CAQH attestation current
• Release and authorization to obtain information
• Current CV with month-and-year history and gaps explained
• License verification printout, dated, for every state Include boards in states where the practitioner no longer practices
• DEA and state controlled-substance registration verification
• Education, training and board certification verification AMA Masterfile or ABMS counts as an approved source for most plans
• NPDB query response, dated
• OIG LEIE, SAM.gov, state Medicaid exclusion and opt-out checks, dated, with any false-positive resolution documented
• Malpractice face sheet and claims history
• Hospital privileges letter(s)
• Site visit or office assessment where the plan requires it (new primary care sites, complaints)
• Committee decision, date and signature; effective date recorded

Hospital privileging

The legal frame

Medicare's hospital Conditions of Participation (42 CFR 482.22) require an organized medical staff that examines the credentials of every candidate and recommends appointments to the governing body, which appoints and grants privileges; bylaws must set the criteria. The Joint Commission, DNV and other accreditors add detailed standards; state hospital licensing law adds more.

Appointment vs privileges

Appointment to the medical staff is membership. Privileges are the specific clinical activities granted, from a core set for the specialty plus special procedures that need additional training or volume. A practitioner can be a member with limited privileges or hold privileges without full membership (telemedicine, allied health).

FPPE and OPPE

Focused Professional Practice Evaluation is the look at a newly privileged practitioner's first cases, or at a concern. Ongoing Professional Practice Evaluation is the continuous review of everyone's performance data. Both feed reappointment.

Reappointment

Periodic reappraisal of each member is required; the interval is set in the bylaws, commonly every two years for hospitals. Reappointment repeats the verification, reviews OPPE data, and re-grants or modifies privileges.

Temporary privileges

Granted by the CEO on the medical staff president's recommendation for a defined patient-care need or while a complete, clean application awaits committee. Time-limited (often up to 120 days) and never a substitute for the full process.

Credentialing by proxy

For telemedicine, a hospital may rely on the distant-site hospital's or telemedicine entity's privileging decisions under a written agreement that meets 42 CFR 482.22(a)(3) and (a)(4): the distant site is Medicare-participating, the practitioner is privileged there and licensed in the patient's state, and performance information including adverse events and complaints flows back.

Reporting

Professional review actions that adversely affect privileges for more than 30 days, and surrenders while under investigation, must be reported to the NPDB (and usually to the state board). Failing to report carries civil monetary penalties.

Delegated credentialing

The forms

PECOS

What it is

The Provider Enrollment, Chain, and Ownership System: the online application, the enrollment record, revalidation, change requests, application fee payment and status tracking. Login uses the Identity & Access Management System (I&A), where a group's authorized official grants staff and surrogates (billing companies, credentialing vendors) access to act for each enrollment.

Online vs paper

PECOS is faster and pre-checks for missing sections; paper forms go to the MAC by mail. Either way the MAC can "develop" the application by requesting more information, and the clock stops until you respond. Unanswered development requests end in rejection.

PTAN

The Provider Transaction Access Number is the MAC's internal enrollment ID, one per enrollment record and location. It is not on the claim (the NPI is) but is needed for the MAC portal, telephone IVR, and many MAC correspondence requirements.

Specialty code

Medicare assigns a two-character specialty code from the enrollment (for example 08 family practice, 11 internal medicine, 50 nurse practitioner). It drives some edits and payment rules and is distinct from the NUCC taxonomy.

Group reassignment

An employed or contracted physician reassigns the right to receive Medicare payment to the group under 42 CFR 424.80. The reassignment lives in the individual's 855I (formerly the 855R) and links the individual's PTAN to the group's PTAN. Claims then bill the group NPI as billing provider and the individual as rendering.

Ordering and referring

A claim for items or services that require an order or referral (DME, home health, lab, imaging, specialist referrals) must carry the NPI of an ordering or referring physician who is enrolled in PECOS (or has an 855O record); otherwise it denies.

The rules that decide money

Opting out of Medicare

Medicaid

State enrollment is required for everyone

Since the 21st Century Cures Act, every provider in a Medicaid managed care plan's network must be screened and enrolled by the state Medicaid agency, not just by the plan (42 CFR 438.602(b)). A plan may sign a network agreement while state enrollment is pending for up to 120 days, then must terminate it if enrollment has not come through.

Screening mirrors Medicare

States apply the same limited, moderate and high risk levels (42 CFR 455.450), including site visits and fingerprint-based background checks for high-risk types, and must revalidate every provider at least every 5 years (42 CFR 455.414). A provider screened by Medicare or another state's Medicaid at the same or a higher level can often have the screening relied on, and the application fee is not charged twice.

Ordering, referring and prescribing

Physicians and other professionals who order or refer for Medicaid beneficiaries must be enrolled (42 CFR 455.410), even if they never bill Medicaid. Claims with an unenrolled ordering provider deny.

MCO loading

After state enrollment, each managed care organization must credential (or accept delegated credentialing) and load the practitioner with its own effective date. A practitioner can be active with the state and invisible to the MCO, which is the most common Medicaid "provider not found" denial.

Effective dates and retro

Vary by state: some make enrollment effective on the application receipt date, some allow retroactive enrollment to the first date of service or up to a year back, some only prospectively. MCOs then apply their own rule. Record both per state and per plan.

Medicaid IDs

Many states still issue a state provider ID alongside the NPI; it is needed for the portal and some paper correspondence. Group and individual records must be linked ("affiliated") in the state system for the group to be paid for the individual's services.

Commercial payers

1. 1

   Contract and products Group level

   The group's participation agreement lists the plan's products (HMO, PPO, exchange, Medicare Advantage, Medicaid managed care). A new practitioner is added under the existing contract. A new group negotiates the contract in parallel with credentialing; many plans will not credential until a contract is at least in progress.

2. 2

   Application Day 0

   Most plans pull the CAQH profile after the practitioner authorizes them; some have a short supplemental form or a provider portal request. Delegated groups send a roster instead. The plan date-stamps receipt of a complete application, which is the clock the state credentialing laws measure.

3. 3

   Verification and committee Commonly 60 to 120 days

   The plan or its CVO verifies to NCQA standards and the file goes to the next credentialing committee, usually monthly. Some states cap this by statute (periods of 60 to 90 days are common), and several require retroactive payment to the application date once approved; check the state insurance code.

4. 4

   Effective date Committee date or later

   Typically the committee approval date, sometimes the first of the following month, sometimes the contract date. Few plans allow retro billing to the start date; those that do require a request, usually within a short window. Ask, in writing, for every new practitioner.

5. 5

   Loading and directory Days to weeks after approval

   The plan builds the provider record for each product and location and publishes the directory listing. Verify by checking the directory and by calling provider services with the NPI and tax ID; then release held claims.

EFT and ERA enrollment

Typical turnaround, 2026

These are typical ranges reported by practices and credentialing vendors rather than regulatory standards. Your own history by payer is the only reliable planning number; keep it.

What shortens the clock

The cycles

Exclusion screening, done properly

Substitute physician billing under Medicare

The rules, in one place

Medicare Claims Processing Manual, chapter 1, section 30.2.10 and following. The regular physician must be an MD or DO; the arrangements also cover outpatient physical therapists in HPSAs, medically underserved and rural areas (since 2017). Services of NPs, PAs and CRNAs may not be billed under either arrangement.

The 60 days

Continuous, counted from the substitute's first day, including days the substitute is not working. A new 60-day period starts only after the regular physician returns to work. A physician who has left the practice permanently cannot be the "regular physician" for a substitute, with a narrow exception for a departed physician's patients during a transition.

Commercial and Medicaid

Many plans recognize Q5 and Q6 by contract or policy; many do not, and some require the locum to be credentialed. Check each plan's policy and the state Medicaid manual before relying on it.

What locums are not

A way to bill a new permanent hire while enrollment is pending. The new physician is not a substitute for an absent one, and billing their work under another physician's NPI is a misrepresentation of who rendered the service.

Legitimate options while a new practitioner's enrollment is pending

• Hold claims by payer and release when the effective date arrives Use the practice management system's provider-payer effective date table; most systems can hold automatically
• Use Medicare's 30-day retrospective window by filing before the start date
• Request retroactive effective dates from commercial plans and MCOs in writing, citing state law where it applies
• Schedule the new practitioner for payers that are live first; shift other patients to enrolled colleagues
• Bill incident-to or split/shared visits only where every element of those rules is met Incident-to requires an established patient, an established plan of care, direct supervision in the office, and the supervising physician's NPI; it does not apply to new patients, new problems, hospital settings or most Medicaid programs
• Never bill under another provider's NPI as a workaround False Claims Act exposure and, for Medicare, a revocation ground

Enrollment denials on the 835

Credentialing and enrollment KPIs

Time to complete file

Days from offer acceptance (or application request) to a complete, verified credentials file. Target: under 30 days. The practitioner's responsiveness is the usual driver; measure it separately.

Time to enrollment, by payer

Days from submission to effective date, tracked per payer and per plan product. This is your planning number for the next hire. Trend it monthly; an upward drift at one plan is worth a call to the provider relations representative.

Share of practitioners fully enrolled at start

New practitioners whose top payers (by expected volume) are all effective on or before the first clinic day. Target: 90% or higher. Below that, the hiring lead time is wrong, not the credentialing team.

Revenue at risk and revenue lost

Charges for services rendered before each payer's effective date (at risk) and the portion that was not recovered through retro effective dates or the 30-day Medicare window (lost). Report it to leadership monthly in dollars.

Enrollment-related denial rate

Claims denied with provider-eligibility codes (CO-16/N290, CO-B7, CO-208, CO-242 and the like) as a share of claims. Target: under 1%. Each one is a record mismatch somewhere upstream.

Expirables current

Percentage of tracked items (licenses, DEA, board, CAQH, malpractice, revalidation) with more than 60 days to expiration. Target: 100%, with a named owner for every exception.

Recredentialing on time

Recredentialing and revalidation files completed before the due date. Target: 100%. A late file is a deactivation or termination waiting to happen.

Roster accuracy

For delegated plans, the share of practitioners whose loaded record (NPI, tax ID, locations, products) matches the group's record at the quarterly reconciliation.

Monthly exclusion screening completed

A yes/no control with evidence: date run, lists, matches investigated, outcomes.

What is changing

Sources

1. Federal Register, December 3, 2025: CY 2026 Medicare, Medicaid and CHIP application fee ($750)
2. CMS: Revalidations (renewing your enrollment)
3. eCFR 42 CFR 424.521: request for payment by provider or supplier (retrospective billing)
4. eCFR 42 CFR 424.540: deactivation of Medicare billing privileges
5. Noridian: provider enrollment reconsiderations, CAPs and rebuttals (deadlines)
6. NCQA: 2025 Credentialing and Provider Network policy updates (effective July 1, 2025)
7. BCBS Illinois: CAQH Provider Data Portal quick reference (120-day re-attestation; 180 in Illinois)
8. TechTarget: half of providers report revenue losses from credentialing delays (Medallion survey, January 2026)
9. MGMA Stat: confronting credentialing and reappointment crunch time (November 2025)