Provider credentialing, explained

Provider credentialing is the formal process of verifying a clinician's qualifications (their education, training, licensure, and history) so a hospital or health plan can confirm they are qualified to deliver care. It is the background check at the heart of healthcare, and it is also the single most common reason a new provider waits months before they can start seeing patients or getting paid.

What credentialing actually is

Strip away the jargon and credentialing answers one question: is this provider who they say they are, and are they qualified to do what they say they do?

To answer it, a hospital, health system, or insurer gathers a provider's professional history (medical school, residency, board certifications, state licenses, work history, malpractice record) and then verifies every piece of it directly with the source that issued it. Not "the provider sent us a copy of their diploma," but "we contacted the medical school and confirmed the degree." That direct-from-the-source standard is the part that makes credentialing slow, and it is also the part that makes it mean something.

The three things everyone confuses

If you remember one section of this guide, make it this one. Three distinct processes get lumped together, and untangling them explains most of the surprises new providers run into.

• Credentialing asks "is this provider qualified?" It is the verification of education, licensure, and history. A hospital, a health plan, or a third-party credentials verification organization (CVO) does it.
• Privileging asks "what specific procedures may they perform here?" It is granted by a facility's medical staff and is specific to that building. A surgeon credentialed at a hospital still has to be privileged for the particular operations they will do there. Private-practice physicians often skip privileging entirely; it is mainly a hospital concept.
• Enrollment (also called payer enrollment or contracting) asks "where and how can they bill and get paid?" It is done separately with each payer (Medicare, Medicaid, and every commercial insurer), and only after it is complete can a provider actually submit claims to that payer.

Credentialing comes first and is the prerequisite for the other two. The reason this matters in practice: a provider can be fully credentialed and still be unable to bill a given insurer, because enrollment with that specific payer has not finished.

Can I bill before I am credentialed?

Generally, no, and trying to is how practices end up writing off claims. Most payers will not reimburse for services delivered before a provider's enrollment effective date with that payer, and credentialing has to be done before enrollment can complete. Some payers allow a degree of retroactive billing back to an application date, and some specialties have locum or supervision arrangements that create exceptions, but the safe assumption is that the clock on getting paid does not start until the paperwork is done.

How long it takes, and why

Initial credentialing typically runs 90 to 180 days, commonly three to six months. Hospitals tend to land toward the faster end, payers toward the slower. Re-credentialing, which happens about every three years for most providers, is quicker because the file already exists.

The delays almost never come from the provider sitting on paperwork. They come from the verification itself: a medical school that takes weeks to confirm a degree, a former employer's records office that does not return calls, a state licensing board working through a backlog. Credentialing is only as fast as the slowest primary source it has to hear back from. What you can control is whether your file gives anyone a reason to stop:

• An incomplete application. Missing fields and unanswered disclosure questions send the whole file back to the start of the queue.
• Unexplained gaps in work history. Every gap has to be accounted for; an unexplained six months will stall a file until someone asks about it.
• Expired documents: a lapsed license, an out-of-date malpractice certificate, an expired board certification sitting in the file.
• A stale CAQH profile. Most commercial credentialing pulls your data straight from CAQH, so an un-attested CAQH record poisons the process before it begins. More on that in our CAQH guide.

What gets verified, and against what

The verification step, formally called primary source verification, is the substance of credentialing. The credentialing staff or CVO confirms each claim with the organization that originally issued it:

• Education and training with the medical school and residency program (and with ECFMG for international medical graduates).
• State licenses with each state's licensing board, which also reveals any disciplinary action or restriction.
• Board certification with the certifying board.
• DEA registration, for providers who prescribe controlled substances.
• Work history with former employers and hospital medical-staff offices.
• Malpractice and claims history, including a check of the National Practitioner Data Bank.
• Sanctions and exclusions against the OIG exclusion list, the federal SAM database, and state Medicaid exclusion lists.

Your NPI is part of this picture too. It is a verified data point, and getting your Type 1 (individual) and Type 2 (organizational) NPIs straight matters, because a mismatch between the NPI a payer expects and the one on file is its own source of denials. If that distinction is fuzzy, our NPI guide lays it out.

What it costs, and what is changing

Credentialing cost is genuinely hard to pin down. It depends on specialty, the number of payers, and whether a practice does it in-house or outsources, so treat any single number with caution. As a rough shape of things, the direct out-of-pocket costs of doing it yourself tend to run modest, while full-service outsourced credentialing is often quoted in the low thousands of dollars per provider, with ongoing maintenance billed monthly. One specific figure surprises people: the Medicare enrollment application fee, which for 2026 is set at $750, applies only to institutional providers and suppliers. Individual physicians and most non-physician practitioners do not pay it.

Credentialing standards are not static, either. The accrediting body NCQA introduced an updated credentialing program taking effect across 2025 and 2026 that consolidates its programs and shortens some verification timeframes, the rationale being that aggregated digital primary sources have made the old manual-era windows obsolete. The exact figures vary by source, so the honest summary is this: the direction is toward faster verification and more continuous monitoring, and the precise numbers are still settling.