Resources
Last updated: May 19, 2026 · By CredentialTrack Pro Editorial Team
Provider credentialing is the formal process of verifying a healthcare provider's qualifications — license, DEA registration, education, training, board certification, work history, and malpractice coverage — before they can practice or bill insurance at an organization. Initial credentialing typically takes 60 to 120 days, must be repeated at least every 36 months under NCQA and Joint Commission rules, and is a separate workflow from payer enrollment. The 61 questions below cover the topics credentialing coordinators ask most often.
Provider credentialing is the formal process of collecting and verifying a healthcare provider's qualifications — including education, training, licenses, board certifications, work history, and malpractice coverage — before they can practice or bill insurance at a given organization. It is required by hospitals, health systems, payers, and accreditation bodies such as the Joint Commission and NCQA.
Initial provider credentialing typically takes 60 to 120 days from a complete application, depending on payer responsiveness and how quickly primary sources reply to verification requests. Hospital privileging adds another 30 to 90 days on top of that, and missing or incorrect application data is the most common reason files stretch past 120 days.
Credentialing verifies who a provider is — their license, education, training, certifications, and work history. Privileging is the separate decision a hospital or facility makes about what specific procedures or services that provider is permitted to perform, based on their documented training, experience, and competency.
A standard credentialing file includes a current state license, DEA registration, NPI, board certification, diploma and residency certificates, ECFMG certificate (for IMGs), malpractice insurance face sheet, work history covering the last 5 to 10 years, immunization and PPD records, and a current CV with no unexplained gaps. Most payers also require a completed and attested CAQH ProView profile.
NCQA, URAC, and the Joint Commission all require providers to be re-credentialed at least every 36 months (three years). Many hospitals and payers run a lighter monthly or quarterly monitoring cycle in between to catch license expirations, sanctions, and new malpractice claims.
In a small practice the office manager or practice administrator usually owns credentialing, often with help from an outside Credentialing Verification Organization (CVO). Larger groups and hospitals employ dedicated Medical Staff Services Professionals (MSPs) — typically certified through NAMSS as a CPCS or CPMSM — to manage the full credentialing and privileging workflow.
Primary source verification (PSV) is the process of confirming a provider's credential directly with the original issuing source — for example, querying the state medical board for a license or the ABMS for board certification — instead of relying on a copy supplied by the provider. PSV is required by NCQA, URAC, the Joint Commission, and CMS for any credential used to make a credentialing decision.
PSV is required for current state license, DEA registration, board certification, education and post-graduate training, malpractice claims history, hospital privileges, work history, and any sanctions or exclusions. Items like the NPI, CV, and immunization records are typically accepted as provider-attested rather than primary-source verified.
A medical license is verified by querying the issuing state medical board directly — either through the board's online lookup, the Federation of State Medical Boards (FSMB Physician Data Center), or a designated equivalent source. The verification must capture the license number, status, issue and expiration dates, and any board actions, and must be dated within the timeframe required by the credentialing body (usually 180 days).
Board certification is verified directly with the certifying board — most commonly the American Board of Medical Specialties (ABMS Certification Matters), the American Osteopathic Association (AOA), or the American Board of Physician Specialties (ABPS). NCQA and the Joint Commission also accept ABMS-designated equivalent sources such as the AMA Physician Masterfile.
NCQA requires primary-source verification of license, DEA, education and training, board certification, work history (5 years), malpractice claims (5 years), Medicare/Medicaid sanctions, and any state licensure sanctions. Verifications must be no older than 180 calendar days at the time of the credentialing decision and must be documented with the source, date, and verifier.
Payer enrollment is the process of registering a provider with a health insurance plan — Medicare, Medicaid, or a commercial payer — so that claims submitted under that provider's NPI will be paid in-network. It is a distinct step from credentialing: a provider can be fully credentialed by a hospital and still not be enrolled (and therefore not reimbursable) with a specific payer.
Medicare enrollment through PECOS typically takes 45 to 90 days for a clean application, and the effective date can be back-dated up to 30 days before the application was received. Applications missing documentation, signatures, or with mismatched NPI/legal-name data are routinely returned and add 30 to 60 days to the process — see the official CMS PECOS portal.
CAQH ProView is a free, centralized provider data repository operated by the Council for Affordable Quality Healthcare. Nearly every major commercial payer pulls credentialing data from CAQH instead of asking each provider to fill out a payer-specific application, so an attested, up-to-date CAQH ProView profile is effectively required to enroll with commercial plans. This is general industry guidance: providers create, attest, and maintain their CAQH profile in CAQH ProView.
Credentialing verifies that a provider is qualified to deliver care at a hospital, group, or health plan. Payer enrollment is the contractual step of being added to a specific insurer's network so claims under that provider's NPI will be reimbursed — many payers run their own credentialing as part of enrollment, but the two are still separate workflows with separate effective dates.
A provider can usually see patients as soon as they are licensed, DEA-registered, and credentialed by the facility, but claims submitted before the payer's enrollment effective date are typically denied or held. Some commercial payers allow retroactive billing back to the application receipt date; Medicare permits up to 30 days of retroactive billing, and Medicaid rules vary by state.
Most state medical licenses renew every 1 to 3 years depending on the state — for example, California and Texas are every 2 years, while Florida is every 2 years on staggered cycles. Each renewal requires payment of a state fee and attestation that any mandated CME has been completed.
A DEA registration is valid for 3 years from the issue date and must be renewed before the expiration date — there is no grace period, and a lapsed registration must be reapplied for from scratch. The DEA sends a single paper renewal notice ~65 days before expiration, so most organizations track DEA dates internally rather than relying on the notice (see DEA Diversion Control).
Practicing on a lapsed license is treated as the unlicensed practice of medicine — it can trigger state board discipline, denial and clawback of all claims paid during the lapse, malpractice coverage gaps, and personal liability for the provider and the employing organization. Most payers also require the organization to self-report the lapse and refund any payments tied to dates of service after the expiration date.
Most credentialing programs store CME certificates against each provider and total them by activity type (Category 1 AMA PRA, state-mandated topics such as opioid prescribing or human trafficking, etc.) for each renewal cycle. The ACCME's CME Passport can also serve as an authoritative source for ACCME-accredited activities.
Nurse practitioners and physician assistants need their own DEA registration if they will prescribe, administer, or dispense any controlled substance (Schedules II–V) and have prescriptive authority for controlled substances under state law. Mid-level prescriptive authority is set state by state, and some states further require a collaborative practice agreement or a separate state-level controlled substances registration in addition to the federal DEA number.
An OIG exclusion check is a search of the HHS Office of Inspector General's List of Excluded Individuals/Entities (LEIE) to confirm that a provider or vendor has not been barred from participation in Medicare, Medicaid, or any other federal healthcare program. The official source is the OIG LEIE online database, which is updated monthly.
The OIG's Special Advisory Bulletin recommends screening all employees, contractors, vendors, and referring providers against the LEIE at least monthly, and most state Medicaid programs require monthly screening as well. SAM.gov should be checked on the same monthly cycle to catch debarment actions that don't appear on the LEIE.
SAM.gov hosts the federal government's consolidated list of parties excluded from receiving federal contracts, grants, and other assistance — including healthcare-related debarments from agencies beyond HHS. A SAM.gov hit can disqualify a provider or vendor from federally funded programs even when they do not appear on the OIG LEIE.
Under federal law, organizations that submit claims for items or services furnished, ordered, or prescribed by an excluded individual can face Civil Monetary Penalties of up to $20,000 per claim, treble damages, and program exclusion of the organization itself. These penalties apply even if the excluded person had no direct patient contact, which is why monthly LEIE/SAM screening is treated as a baseline compliance control.
CredentialTrack Pro has four tiers: Clinician at $4/month ($40/year) for nurses and scrub techs with limited provider types; Provider at $59/month for physicians, PAs, and NPs with 50+ provider types on a single seat; Practices at $99/month base plus $29 per seat for group practices; and Custom enterprise pricing via sales. Independent coordinators are free forever. See the pricing page for the full comparison.
The Clinician plan is $4 per month or $40 billed annually. It is sized for nurses and scrub techs managing a single provider with limited provider types, and includes CE/CME tracking, bulk import, AI document OCR, and MFA enforcement. Every paid plan includes a 14-day free trial with no credit card required to start.
The Provider plan is $59 per month for a single seat. It covers physicians, PAs, and NPs across 50+ provider types and adds automated PSV workflows, application management, compact license awareness, reappointment calendar, and data export on top of Clinician features.
Practices is $99 per month base plus $29 per seat per month. One seat equals one active provider profile. Admin and coordinator user accounts do not count toward the seat total. Practices includes privileging workflows, credentialing committee support, organization accreditation, provider comparison, and advanced analytics.
Yes. Independent credentialing coordinators get a free-forever account with no credit card and no trial. Coordinators can accept shared access from providers (read-only or edit) and manage the providers they support from one dashboard. Paid plans start at $4/month for Clinician ($40/year billed annually).
Yes. Every paid plan includes a 14-day free trial with full feature access and no credit card required to start. Add a payment method by day 14 to keep durable access; if no card is on file when the trial ends, access pauses but your data stays. Independent coordinator accounts are free forever and do not use a trial.
Durable access pauses until a payment method is added. Your account and credential data are retained so you can resume by updating billing. This is different from signup, which never requires a card to start the trial.
Yes. You can upgrade or downgrade anytime from billing settings. Changes take effect immediately with prorated charges.
Yes. Annual billing saves 20% versus monthly. You can choose monthly or annual on paid plans from the pricing page.
Custom enterprise plans include everything in Practices plus webhook subscriptions, API access, priority support, and named enterprise integrations — Nursys, CAQH, FSMB, ABMS, NABP, and FSBPT — which are coming soon and not live yet. Contact sales for pricing.
CredentialTrack Pro is medical credentialing software for tracking provider licenses, DEA, board certifications, CE/CME, hospital privileges, payer-enrollment status, and related documents — with expiration alerts, verification workflows, and audit-ready reporting. It replaces spreadsheets and shared drives for practices, hospitals, coordinators, and individual providers.
Provider, Practices, and Custom plans support 50+ clinical provider types, including physicians, NPs, PAs, nurses, therapists, and allied health roles. The Clinician plan is limited to a smaller set of types for nurses and scrub techs.
Yes. Paid plans include CE/CME tracking with renewal alerts and gap visibility on the dashboard. Provider and higher tiers add reappointment calendar support. NPI lookup does not silently populate CE. When provider type and state are known, any training or CE suggestion shown must be reviewed and confirmed before it is applied. Requirements can vary by specialty and state board rules.
Not automatically. NPI lookup fills identity details (name, provider type/specialty when mapped, primary license state, and practice address). When NPI, provider type, and license state are known, CredentialTrack Pro can suggest training and CE requirements from the requirements library and ask you to confirm (Review / Add Selected) before they are applied. It does not silently fill required training or CE without your confirmation.
NPI lookup on Add Provider fills from the NPI Registry: first name, last name, provider type/specialty when mapped, primary license number and state when available, and practice address (street, city, state, ZIP). It does not fill work email or create or verify a full license credential record, and it does not silently apply training/CE. After save, when type and state are known, you may get a suggestion to review and confirm training/CE from the requirements library.
Open the provider profile. When CredentialTrack Pro has a suggestion from the requirements library, use the Review flow on Training & CE requirements, then Add Selected (or confirm) to apply what you approve. Suggestions are not applied until you confirm.
CredentialTrack Pro includes automated and guided PSV workflows for credential files, including checks against sources such as the NPI registry, OIG/SAM exclusion lists, and license boards as product capabilities. Named enterprise board and registry integrations (Nursys, CAQH, FSMB, ABMS, NABP, FSBPT) are coming soon and are not live connectors today.
No live CAQH API or Direct Assure integration is available today. Providers should create, attest, and maintain their CAQH ProView profile directly in CAQH. Marketing illustrations that show a CAQH status as connected are product demos only — not a live connection. Named enterprise integrations including CAQH are coming soon.
CredentialTrack Pro helps teams track payer-enrollment status and related credentialing work. It does not currently submit live applications through CAQH or payer APIs. Keep external payer and CAQH workflows in those systems until enterprise integrations ship.
Yes. Compact license awareness is included on Provider, Practices, and Custom plans to help teams track multi-state compact credentials alongside state licenses.
Yes. CredentialTrack Pro can help surface state- and specialty-oriented credential and CE requirement guidance as you set up provider profiles. Treat AI-assisted requirements as a starting point and confirm against your board and payer rules when decisions are high-stakes.
Medical credentialing software is a system of record for provider qualifications — licenses, DEA, board certifications, malpractice, CME, hospital privileges, and payer enrollment — with built-in expiration tracking, document storage, primary-source verification workflows, and exclusion monitoring. It replaces the spreadsheets, shared drives, and email reminders that small practices traditionally use to keep providers compliant and billable.
CredentialTrack Pro plans start at $4/month ($40/year) for Clinician, $59/month for Provider (single seat), and $99/month base plus $29 per seat for Practices. Independent credentialing coordinators get a free-forever account. Custom enterprise pricing is available through sales. Full plan details are on the pricing page.
Even practices with only a handful of providers tend to outgrow spreadsheets quickly because licenses, DEA registrations, board certifications, malpractice policies, and CME deadlines all expire on independent cycles. Dedicated software pays for itself the first time it prevents a missed renewal — a lapsed license or DEA can result in denied claims, payer recoupment, and gaps in malpractice coverage.
No. CredentialTrack Pro stores provider credentialing records and professional PII — licenses, NPI, DEA, board certifications, CEU/CME, hospital privileges, payer-enrollment status, and malpractice coverage. It is not intended for patient treatment, diagnosis, or billing records. We do not claim HIPAA certification. A Business Associate Agreement (BAA) may be available on request for approved organization use cases — contact security@credentialtrackpro.com. Signup clickwrap covers Terms of Service, Privacy Policy, and the Provider Credentialing Data Notice; it is not a BAA.
Some credentialing platforms can pull provider profile data from CAQH ProView through the CAQH Direct Assure / API program. CredentialTrack Pro does not currently offer a live CAQH API or Direct Assure integration; its named enterprise integrations — Nursys, CAQH, FSMB, ABMS, NABP, and FSBPT — are coming soon. For now, CredentialTrack Pro helps teams organize provider records and track credentialing work while providers manage their external CAQH ProView profile directly.
CredentialTrack Pro encrypts data with AES-256 at rest and TLS 1.2 or higher in transit, applies field-level encryption for sensitive identifiers such as NPI, DEA, license numbers, and SSN, enforces role-based access control, supports MFA, and keeps an append-only audit log. Customer data is stored in the United States. See the Security page for the full controls inventory.
No. We do not claim HIPAA certification. The platform is designed to align with HIPAA Security Rule safeguards for professional credentialing data and is not intended for patient clinical records. A BAA may be available on request for approved organization use cases — email security@credentialtrackpro.com.
Not yet. Controls are SOC 2 readiness-aligned, and a SOC 2 Type II attestation is in progress but not completed. When you see SOC 2 Ready, it means alignment with the criteria — not that an attestation report has been issued.
Product questions: check the FAQ or email support@credentialtrackpro.com. Security issues and BAA or security questionnaires: security@credentialtrackpro.com. Privacy: privacy@credentialtrackpro.com. Legal: legal@credentialtrackpro.com. There is no public Report a Bug path for visitors.
On signup you choose: Credentialing Coordinator (free forever); Practice Owner / Manager; Individual Provider; or Organization Administrator. Practice Owner and Organization Administrator both create organization accounts that own billing. Individual Provider manages a personal credential profile.
No. Paid plans start with a 14-day free trial and no credit card required. Coordinator accounts are free forever with no card. Add a card by day 14 on a paid trial to keep durable access after the trial ends.
For Individual Provider, an Individual NPI Number field is available inline and optional. If entered, CredentialTrack Pro looks the NPI up in the NPI Registry and can fill first and last name from a confirmed individual result. Organization NPIs are rejected for that field.
Signup requires agreeing to the Terms of Service, Privacy Policy, and Provider Credentialing Data Notice. That clickwrap is not a Business Associate Agreement. BAA discussions for approved organization use cases go through security@credentialtrackpro.com.
Yes. CredentialTrack Pro sends a short onboarding and trial drip during the 14-day trial, including reminders as the trial end approaches so you can add billing if you want continued access. Exact send days can change; check your inbox and spam folder for messages from CredentialTrack Pro.
On Practices, seats are active provider profiles only. Admin and coordinator user accounts do not burn provider seats. Independent coordinators can also use a free-forever personal account and accept shared access from providers.
Still have questions? See the pricing page for plan details or head back to the CredentialTrack Pro home page for a full product overview.
Reviewed May 19, 2026 by the CredentialTrack Pro Editorial Team. Sourced from NCQA, the Joint Commission, CMS PECOS, CAQH, the OIG, and the DEA Diversion Control Division.