Credentialing 101 for New Residents
A 12-slide presentation on what new residents need for credentialing and how to store and maintain their records. Includes speaker notes.
For providers
Getting credentialed: a guide for providers
Plain-language help for physicians and advanced practice providers (APPs): what credentialing and privileging are, what to have ready, and how to avoid delays. Each fact links to its source. Where something is general practice rather than a rule, we say so.
On this page: What it is · Start here · Checklist download · What to have ready · Timeline · Privileges · Payor enrollment · DEA · Medicare opt-out · Self-checks · Licensure compacts · Attestation · Recredentialing · Keep it current · Tips · FAQ · Print this page
What credentialing and privileging are
Credentialing is how a hospital, health plan or group checks that you are who you say you are and are qualified: your license, education, training, board certification, work and malpractice history, and more. They confirm most of it with the original source (primary source verification), not just your copies. See the verification crosswalk.
Privileging is how a hospital decides which services you may perform there, based on your training and current competence. For Medicare hospitals, the medical staff examines your credentials and recommends you to the governing body, which makes the appointment, and the medical staff must periodically re-appraise you (42 CFR 482.22). Read 42 CFR 482.22 (opens in new tab)
Payor enrollment is separate: it's how you get set up to bill a health plan, Medicare or Medicaid. See Payor enrollment.
Why it matters to you
- You can't treat patients at a hospital until you have privileges there. The Joint Commission allows temporary privileges for a new applicant only when the application is complete and raises no concerns, and for no more than 120 days (TJC FAQ (opens in new tab)).
- Gaps, missing documents and answers that don't match what's verified slow files down. NAMSS lists "discrepancy between information disclosed and information verified" as a red flag (NAMSS ICS).
Start here
- Get or update your NPI in NPPES (opens in new tab) and check your record in the NPI Registry (opens in new tab).
- Gather your documents with the Provider Document Checklist, using MM/YY dates and explaining any gap over 30 days (NAMSS ICS).
- Check your own records the way a credentialer will. See Self-checks.
- Set up or re-attest CAQH ProView and authorize the plans you're applying to (CAQH ProView (opens in new tab)).
- Apply for privileges and answer every attestation question fully. See Privileges and Attestation.
- Enroll with payors: Medicare in PECOS, your state Medicaid, then commercial plans. See Payor enrollment.
- Track renewals so nothing lapses. See Keep it current.
Download: Provider Document Checklist
Print it or fill it in, then check items off as you gather them.
Provider Document Checklist
A one-stop list for physicians and APPs to gather before applying: identity and NPI, CV and work history (MM/YY, gaps over 30 days explained), education and training, licenses, DEA/CDS, board certification, malpractice COI and claims history, references, affiliations, life support, immunizations, CAQH ProView, case logs, CME, and APP agreements. Check each item, note expiration dates and keep it with your copies.
Who uses it: Providers · Office & Group Enrollment · Hospital MSP
General checklist, not legal advice
More free forms: Peer Reference Request · Work History Verification · Work History Gap Explanation · all templates →
What to have ready
Gather these before you start. Our Provider Document Checklist has the same list in Word and fillable PDF.
- CV with month/year datesList education, training and every job and affiliation with start and end dates in MM/YY format, and explain in writing any gap of more than 30 days. Source: NAMSS Industry Credentialing Standards (opens in new tab). Use our Work History Gap Explanation form.
- Government-issued photo IDA driver's license or passport. NAMSS recommends the organization confirm your identity in person or virtually before you see patients, and says it shouldn't keep a copy (NAMSS ICS).
- NPIYour National Provider Identifier and the details on your NPPES record (name, taxonomy, practice address). Keep them current in NPPES (opens in new tab).
- State licensesEvery license you hold or have held: state, type, number, status, issue and expiration dates. NAMSS says applicants should explain any discipline, suspension, probation or reprimand in writing (NAMSS ICS). Board lookups are in the State directory.
- DEA and state controlled substance registrationsYour DEA registration certificate(s), plus any state CDS/CSR registration your state requires. See state controlled substance registration.
- Board certificationCertificate or board status, including dates and any upcoming MOC or recertification deadlines. Board lookups are on the PSV sources page.
- Diplomas and training certificatesProfessional school diploma, internship, residency and fellowship certificates with dates (MM/YY). International medical graduates: your ECFMG certificate (ECFMG Certification (opens in new tab)). NAMSS lists ECFMG certification 'if applicable' (NAMSS ICS).
- Malpractice certificate of insurance and claims historyA current certificate of insurance (COI); all carriers for at least the past 5 years with coverage dates, types and policy numbers; and a list of open, pending, settled, closed and dismissed cases (NAMSS ICS). Carriers can send loss runs: see Malpractice.
- Peer and professional referencesNames and current contact details. NAMSS says professional references should have worked directly with you in the past 2 years (for example your program director, chair or medical director), and peer references should share your discipline or license type. They'll be sent your privileges request (NAMSS ICS).
- Hospital affiliations and work historyEvery facility where you've held privileges and every employer or contract (including locums and telemedicine companies) since training, with MM/YY dates (NAMSS ICS). Military service: your DD214 if discharged in the past 5 years (NAMSS ICS).
- Life support certificationsBLS, ACLS, PALS, NRP or ATLS as your department or specialty requires: check with the medical staff office. Card providers are listed under Life support certifications.
- Immunizations and health screeningRecords your organization's occupational health policy asks for (general practice: the hospital decides). CDC's recommendations for healthcare personnel are linked from its Pink Book Appendix A (opens in new tab). Expect a health status question on the application (see Attestation below).
- CAQH ProView profile (DataSpring)Many health plans pull your application data from CAQH ProView (opens in new tab) (CAQH is now DataSpring). Keep documents current and re-attest at least every 120 days (180 days for Illinois providers), per CAQH's ProView quick reference guide (opens in new tab).
- Case logsProcedure or case logs that support each privilege you request, with dates and volumes. See Requesting privileges.
- CME certificates, if requiredMany state boards require CME for license renewal; FSMB's CME by state overview (opens in new tab) lists them. Some hospitals and boards ask for proof. See CME.
- For APPs (NP, PA, CRNA, CNM)Your graduate program diploma and transcript, national certification (for example NCCPA, AANPCB, ANCC or NBCRNA), and any collaborating or supervising agreement your state requires. See APP supervising & collaborating agreements.
How long it takes
It varies. We didn't find an official published range for how long credentialing or privileging takes, so we don't quote one. It depends on the organization, how fast schools, boards, hospitals and references respond, and when committees meet.
What we can say from the sources:
- Steps take turns. For Medicare hospitals, the medical staff reviews and recommends, then the governing body decides (42 CFR 482.22). Many hospitals also route files through a department chair, credentials committee and medical executive committee (general practice). Missing a meeting can add weeks.
- Verifications expire. NAMSS recommends that verifications be no more than 180 days old at the credentialing decision, and NCQA requires most to be no more than 120 days old for NCQA-accredited organizations and health plans (verification time limits), so a stalled file may need items re-checked.
- Temporary privileges are limited to 120 days for new applicants under TJC's FAQ. They aren't a substitute for finishing the file.
Tip (general practice): ask the medical staff office or enrollment team for their committee calendar and the date your complete file must reach them.
Requesting privileges
Core and special privileges
Many hospitals group privileges into a core list (what a trained specialist in your field typically does) and special or non-core privileges (procedures that need extra training, volume or equipment). Each has its own criteria (general practice; your hospital's delineation of privileges sets the rules). Our Privileging Request Form Outline shows the structure.
Back each request with evidence
- Request only what you do now and can document. Attach case or procedure logs with dates and volumes for each special privilege (general practice; see matching privileges to case logs).
- NAMSS recommends that your references get a copy of the privileges requested and are asked to recommend them (NAMSS ICS). Tell them what you're requesting.
After approval: FPPE
Under TJC's FAQ, a focused professional practice evaluation (FPPE) is required for all newly granted privileges, whatever your experience or board status, and it starts when privileges are granted, including temporary privileges. It may involve chart review, observation or proctoring. Ask what your FPPE plan is and how many cases it needs. See FPPE, proctoring & temporary privileges.
Payor enrollment in brief
NPI first
Get or update your NPI in NPPES (opens in new tab). Plans and Medicare use it to identify you. More on the PSV sources page.
Medicare: PECOS
Medicare enrollment, reassignments and revalidations are done in PECOS (CMS PECOS information (opens in new tab)). CMS says most providers revalidate every five years (CMS revalidations (opens in new tab)).
Medicare paper forms: CMS-855
If you enroll on paper instead of PECOS: physicians and non-physician practitioners use the CMS-855I (opens in new tab); clinics/group practices and certain other suppliers use the CMS-855B (opens in new tab). The CMS-855R is no longer used: reassignments are reported on the CMS-855I (CMS bulletin, PDF (opens in new tab)).
Medicaid: your state
Each state runs its own Medicaid enrollment. States must require ordering or referring practitioners to be enrolled (42 CFR 455.410(b), read it (opens in new tab)). Find your state's portal in the State directory.
Commercial plans: CAQH ProView
CAQH ProView (opens in new tab) shares your attested application data and documents with the health plans and organizations you authorize. Authorize the plans you're applying to and keep the profile attested.
Track every application
Log submissions, follow-ups and effective dates with our free Provider Enrollment Tracker and Payer Follow-up Log.
DEA registration
- Renew online. DEA says new applications and renewals must be submitted online, and it sends renewal reminder emails 60, 45, 30, 15 and 5 days before your registration expires (DEA Registration (opens in new tab)).
- One registration per place of practice. The DEA Practitioner's Manual says a separate registration is required for each principal place of business or professional practice at one general physical location where controlled substances are dispensed (21 CFR 1301.12(a); Practitioner's Manual (PDF) (opens in new tab)).
- 8-hour training attestation. Starting with your first new or renewal registration on or after June 27, 2023, you attest that you completed 8 hours of training on opioid or other substance use disorders (DEA Registration (opens in new tab)).
How credentialers verify a DEA registration: DEA on the PSV sources page.
Medicare opt-out
Some practitioners choose not to bill Medicare at all. Per CMS (Manage Your Enrollment (opens in new tab)):
File an affidavit with each MAC
To opt out, you file an opt-out affidavit with each Medicare Administrative Contractor (MAC) that has jurisdiction over the claims you would otherwise file, and you must have a private contract with each Medicare patient you treat.
2-year term, renews automatically
An opt-out lasts 2 years and renews automatically for another 2-year cycle. You can't be enrolled and opted out at the same time, except to get paid for emergency or urgent care.
Cancel at least 30 days ahead
To stop the automatic renewal, send written notice to each MAC you filed with at least 30 days before the end of the current 2-year period.
90-day early termination
You can end a first-time opt-out within 90 days of filing the initial affidavit. Once an opt-out has renewed automatically, you can't end it early.
Self-checks: look yourself up first
Credentialers check these sources. Look yourself up first so you can fix errors or prepare explanations before they ask.
| Check | What you'll see | Look it up | How credentialers use it |
|---|---|---|---|
| NPI | Your public NPI record from NPPES | NPI Registry (opens in new tab) | PSV: NPPES |
| Medicare revalidation | Your revalidation due date. CMS posts due dates 7 months in advance (CMS (opens in new tab)). | Medicare Revalidation List (opens in new tab) | Keep it current |
| Board certification | ABMS member board certification status | ABMS Certification Matters (opens in new tab) | PSV: ABMS |
| Licenses and board actions | Physician licenses and public board actions (DocInfo); credentials you store with FSMB (FCVS) | DocInfo (opens in new tab) · FSMB FCVS (opens in new tab) | PSV: DocInfo · Verification: FCVS |
| Federal exclusions | Whether you appear on the OIG List of Excluded Individuals/Entities (LEIE) | OIG LEIE (opens in new tab) | PSV: LEIE search |
Also see the exclusion and sanction checks page and your state board on the States page.
Licensure compacts
Compacts can make licensure in other states faster. Each compact's site lists the member states and how to apply.
IMLC (physicians)
The Interstate Medical Licensure Compact offers a voluntary, expedited pathway to licensure for qualified physicians who want to practice in more than one state. imlcc.com (opens in new tab) · PSV: IMLC
Nurse Licensure Compact (RNs, LPNs)
The NLC lets nurses hold one multistate license with the ability to practice in all compact states. nursecompact.com (opens in new tab)
PA Licensure Compact
Lets eligible PAs get a compact privilege to practice in other participating states. Check the commission's site for when privileges become available. pacompact.org (opens in new tab)
Counseling Compact (LPCs)
Lets licensed professional counselors apply for the privilege to practice in other member states. counselingcompact.gov (opens in new tab)
PSYPACT (psychologists)
Lets licensed psychologists practice telepsychology across member states with an Authority to Practice Interjurisdictional Telepsychology (APIT), which requires an ASPPB E.Passport. psypact.gov (opens in new tab)
Attestation & disclosure: answer fully and honestly
Disclose everything asked
Organizations check your answers against primary sources and the National Practitioner Data Bank (NPDB). Hospitals must query the NPDB when you apply and at least every 2 years (45 CFR 60.17, read it (opens in new tab)). NAMSS treats a mismatch between what you disclosed and what's verified, and licenses found that weren't disclosed, as red flags (NAMSS ICS). Omissions can cost more than the issue itself.
For Medicare enrollment, CMS may deny an application with false or misleading information, and can bar re-enrollment for up to 10 years when information was false, misleading or omitted (42 CFR 424.530(a)(4) and (f), read it (opens in new tab)).
Explain claims and actions
NAMSS says applicants should give a written explanation of any license discipline, suspension, probation or reprimand, and list open, pending, settled, closed and dismissed malpractice cases (NAMSS ICS). For each, a short factual note with dates, what was alleged, your role and the outcome helps reviewers (general practice). You can check what the NPDB holds about you with a self-query (opens in new tab).
Health status question
NAMSS recommends asking only about a current condition that isn't being appropriately treated and that impairs your ability to practice, in line with the Dr. Lorna Breen Health Care Provider Protection Act (NAMSS ICS). Answer the question your organization asks.
Medicare attestation statement
At hospitals paid under Medicare's inpatient prospective payment system, physicians sign an acknowledgment that they received notice of the penalties for falsifying information, when granted admitting privileges or before or at the first admission (42 CFR 412.46). See Medicare Practitioner Acknowledgment.
Recredentialing: how often
Credentialing isn't one-and-done. You'll be re-checked on a cycle, and some items are monitored continuously.
| Who | How often | Source |
|---|---|---|
| Hospitals (Medicare Conditions of Participation) | Periodic appraisal. If state law doesn't set a timeframe, CMS recommends at least every 24 months. | CMS State Operations Manual, Appendix A, interpretive guidelines for §482.22(a)(1). Read Appendix A (PDF) (opens in new tab) |
| Hospitals accredited by The Joint Commission | Appointment and privileges for no more than 3 years, or a shorter period if law or regulation requires it. This changed from 2 years, effective Feb 19, 2023. A hospital may still choose a shorter cycle. | NAMSS's three-year reappointment resource quotes the revised TJC standards (MS.06.01.07 EP 9, MS.07.01.01 EP 3). Read the NAMSS resource (PDF) (opens in new tab) |
| Hospitals: NPDB query | At least every 2 years for anyone on the medical staff or with privileges. | 45 CFR 60.17. Read it (opens in new tab) |
| Health plans (NCQA) | Recredentialing every three years. | NCQA. Read NCQA's article (opens in new tab) |
| Medicare enrollment | Revalidation generally every five years. | CMS. Revalidations (opens in new tab) |
| CAQH ProView | Re-attest at least every 120 days (180 days in Illinois). | CAQH. Quick reference (PDF) (opens in new tab) |
Your state's hospital licensing rules or your bylaws may set a shorter cycle. Check with your medical staff office.
Keep it current
Renewals you're responsible for. Put each date on your calendar.
| Item | How often | Source |
|---|---|---|
| CAQH ProView attestation | At least every 120 days (180 days in Illinois) | CAQH. Quick reference (PDF) (opens in new tab) |
| DEA registration | Renew online before it expires. DEA sends reminder emails 60, 45, 30, 15 and 5 days before expiration. | DEA. Registration (opens in new tab) · DEA section |
| State license | Varies by state and profession | Your state board. See the States page. |
| Board certification (continuing certification / MOC) | Varies by board | ABMS. Board certification requirements (opens in new tab) |
| Medicare enrollment revalidation | Generally about every 5 years. Look up your due date on the Medicare Revalidation List (opens in new tab). | CMS. Revalidations (opens in new tab) |
| Medicare opt-out | 2-year term that renews automatically. Cancel at least 30 days before it ends. | CMS. Manage Your Enrollment (opens in new tab) · Opt-out section |
Tips to speed things up
- Start early and send a complete packet. Use the checklist and send everything at once (general practice).
- Make your dates match. Use MM/YY everywhere and explain gaps over 30 days up front (NAMSS ICS). Dates that don't match across your CV, application and verifications cause follow-up.
- Keep CAQH ProView current and re-attest at least every 120 days (180 in Illinois), per CAQH. Upload new licenses, COIs and certificates when they renew.
- Brief your references and confirm their email and phone. NAMSS says they should have worked with you directly in the past 2 years and will be asked about your privileges request.
- Sign every release and attestation the first time. Schools, hospitals and references often won't answer without your signed release (general practice).
- Answer requests within a day or two and keep copies of everything you send (general practice).
- Track expiration dates for licenses, DEA, board certification, life support cards and malpractice so nothing lapses mid-file (general practice).
FAQ
How long does credentialing take?
It varies. We didn't find an official published range, so we don't quote one. See How long it takes.
Can I start working on temporary privileges?
Under TJC's FAQ, temporary privileges for a new applicant are limited to 120 days and need a complete application that raises no concerns. See Privileges.
How do I explain a gap in my work history?
NAMSS ICS asks for a written explanation of any gap of more than 30 days. Our Work History Gap Explanation form helps you list each one.
How often do I re-attest CAQH ProView?
At least every 120 days (180 days in Illinois), per CAQH.
Do I need a separate DEA registration for each location?
DEA requires a separate registration for each principal place of practice where controlled substances are dispensed (Practitioner's Manual). See DEA registration.
How often does Medicare revalidate my enrollment?
CMS says most providers revalidate every five years. Check your due date on the Medicare Revalidation List (see Self-checks).
Can I undo a Medicare opt-out?
You can end a first-time opt-out within 90 days of filing. Otherwise it renews every 2 years unless you cancel at least 30 days before the period ends. See Medicare opt-out.
How often will a hospital re-credential me?
TJC-accredited hospitals reappoint for no more than 3 years at a time, and hospitals query the NPDB at least every 2 years. See Recredentialing.