Provider credentialing checklist

What credentialing is, and why small practices skip it at their peril

Credentialing is checking that a provider is who they say they are, holds the licenses and qualifications the job requires, and has nothing in their history that rules them out. Hospitals and health plans do it formally, with committees and accreditation standards. Many small practices do it informally, or not at all beyond a glance at a license certificate.

The informal approach fails in predictable ways: a license that lapsed last month, a disciplinary order the provider didn’t mention, a Medicaid termination in another state, or an OIG exclusion that makes every claim for that provider’s work a liability. Each of these can be found in minutes from free public sources. The checklist below puts them in order.

Step 1. What to collect from the provider

Step 2. What to verify, where, and how often

Copies tell you what to look for; the check happens at the source. Print or save each result with the date, and note who checked.

The National Practitioner Data Bank

The NPDB is a federal database of malpractice payments and adverse actions against health care practitioners: license actions, clinical privilege actions, professional society actions, DEA actions and exclusions. Hospitals must query it when a practitioner applies for medical staff membership or privileges, and every two years after that (45 CFR 60.17). Group practices that provide health care and follow a formal peer review process may query it but are not required to (NPDB). If your practice qualifies, a query is the quickest way to see a provider’s reported history across states.

Exclusions: the check most often skipped

An excluded person may not furnish items or services paid by Medicare, Medicaid or other federal health care programs, and OIG says the ban covers administrative and management services as well as patient care (OIG Special Advisory Bulletin, 2013). Check three kinds of list: the OIG LEIE, SAM.gov and the state Medicaid lists. Our guide to OIG vs SAM vs state lists explains what each one catches, and our free exclusion check searches OIG, SAM.gov and 31 state lists in one go.

Step 3. Review and decide

Put everything in one file and look at it as a whole. Most findings are questions rather than answers:

• A public board order or probation. Read the order. What were the conditions, are they finished, does the job fit within them?
• A malpractice payment. One payment in a long career in a high-risk specialty means something different from several recent ones.
• A gap in work history. Ask. Illness, family leave and study are common and legitimate.
• A possible exclusion match. Confirm or rule it out with identifiers before deciding. A confirmed exclusion is a hard stop for any work paid by federal programs.

Write down the decision, who made it and why, especially when you proceed despite a finding.

Red flags worth a second look

• Names that don’t line up across the ID, the license, the NPI record and the CV. Usually a marriage or a middle name; occasionally a sign that a record belongs to someone else.
• A license surrendered “voluntarily” in another state. Surrenders often settle a disciplinary case; read the board’s record.
• Several short jobs in a row with vague reasons, especially if references are hard to reach.
• A state the provider didn’t mention showing up in the NPI record or the NPDB response. Check that state’s board and Medicaid list too.
• An attestation answer that contradicts a record. The mismatch matters more than the underlying event: it is a candor problem.
• A reluctance to sign the release or to give former names. Without them, you cannot do the checks properly.

None of these is a verdict by itself. Each is a reason to ask a direct question and write down the answer.

Step 4. Payer enrollment

Verification makes the provider safe to hire; enrollment makes their work payable. Medicare enrollment runs through PECOS, Medicaid through each state, and commercial plans through their own applications, often fed by CAQH ProView. Medicare requires most enrolled providers to revalidate their enrollment on a regular cycle, and plans re-credential on their own schedules, so record every enrollment date and ID in the same file. Enrollment is usually the slowest part of onboarding; start it the day the provider signs.

Step 5. Ongoing monitoring

Credentialing isn’t finished on day one. Licenses expire, boards act, and people are excluded after they’re hired. Standards are moving the same way: in its March 2025 policy updates, NCQA moved ongoing monitoring of adverse events from at least every six months to at least monthly for files on or after July 1, 2025, and shortened several verification time limits (NCQA, 2025).

Practice Pro does the monthly part for you: it re-screens your saved list every month (with a weekly check in between) and emails you 60 and 30 days before each license expiry date you save. It doesn’t read license records from state boards, so the renewal itself is still confirmed on the board’s site.

What applies to which role

Not every item applies to every person. Exclusion screening applies to everyone, including people who never see a patient. The rest depends on the role:

Telehealth and multistate providers

As a general rule a provider needs to be licensed where the patient is located at the time of the visit, not just where the provider sits. That makes telehealth providers the ones most likely to hold several licenses, and the ones whose files most often have an expired license in a state they still see patients from. For each telehealth provider, list every state where they see patients, check each license, and set a reminder for each expiry. Interstate compacts for physicians, nurses, psychologists, counselors and others make it easier to get licenses in several states; they don’t remove the need to check each one. Because state rules differ and change, confirm the requirement with each board.

How to keep the credentialing file

A file that is easy to audit has the same structure for every provider. One simple layout:

1. Summary sheet: name and former names, NPI, every license with number, state and expiry, DEA and expiry, board certification and expiry, insurance and expiry, date credentialed, re-credentialing due date.
2. Application and attestation, signed and dated.
3. Verifications, one per credential, each with the source, the date and who checked. A dated PDF or screenshot of the board record is fine for most practices.
4. Exclusion screening records, at hire and every month after, with the lists and dates used.
5. Decision record: who approved, when, and notes on any finding.
6. Enrollment records: each payer, the ID and the effective date.

Keep files for as long as your state, payers and accreditors require, and at least as long as claims for that provider’s work could be reviewed. Files contain personal data, so store them securely and limit access.

Doing it in-house or outsourcing

A practice with a handful of providers can do this in-house in an afternoon per provider, using free sources: board searches, Nursys, the certifying boards, the exclusion lists and, where eligible, the NPDB. Larger groups often use a credentials verification organization (CVO) or software, especially for payer enrollment, which is the most time-consuming part. Health plans sometimes delegate credentialing to large groups that meet their standards. Whichever route you take, the practice still owns the decision and the monitoring, and an auditor will ask to see both.

Three examples

The providers and practices below are invented.

1. A physician assistant with three licenses

An urgent care group hires a PA who has worked in Arizona, Nevada and Utah. Her NPI record lists only Arizona. The office checks all three boards: Arizona active, Nevada expired by choice, Utah active with an expiry in two months. It diaries the Utah date, screens the exclusion lists, and starts Medicare and Medicaid enrollment the same day.

2. A therapist with a gap

A physical therapy clinic sees a 14-month gap on a candidate’s CV. Asked, he explains a family illness and provides a short letter. Everything else verifies cleanly. The clinic records the explanation and proceeds.

3. A monthly screen finds what credentialing couldn’t

A behavioral health practice credentialed a counselor cleanly two years ago. In month 25 of its monthly screen, a state Medicaid list shows a new termination. The practice confirms the record, pulls the counselor from Medicaid patients while it investigates, and calls counsel. The initial file was perfect; only monitoring caught the change.

Common credentialing mistakes

1. Accepting copies instead of checking the source.
2. Checking only the state where the practice is located.
3. Treating the NPI record as a license check.
4. Screening exclusions at hire only.
5. Skipping non-clinical staff and contractors for exclusions.
6. Not recording expiry dates, then finding a lapsed license during an audit.
7. Keeping no dated evidence of what was checked.

What this checklist can and can’t do

• It covers what most practices, clinics and staffing firms need. Hospitals, health plans and accredited organizations have extra rules from CMS, The Joint Commission, NCQA or URAC; follow the standards that apply to you.
• Our tools check exclusions and link to official license searches. They don’t query the NPDB, verify education or DEA registrations, or enroll providers with payers.
• State rules on background checks, attestation questions and record keeping vary.

Questions

Sources

1. 45 CFR 60.17, Information which hospitals must request from the NPDB — hospitals must query the NPDB at application and every two years
2. NPDB, Group medical practices and ambulatory surgery centers (who may query) — group practices with peer review may query the NPDB
3. NPDB, Hospitals (query requirements) — NPDB query requirements for hospitals
4. NCQA, 2025 Credentialing policy updates (released March 31, 2025) — NCQA 2025 changes: shorter verification time limits and monthly ongoing monitoring of adverse events from July 1, 2025
5. HHS OIG, Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs (May 2013) — screening employees and contractors monthly; administrative services; all names used
6. CMS, State Medicaid Director Letter #09-001 (January 16, 2009): providers should search for excluded employees and contractors monthly — CMS asks states to require monthly searches for excluded employees and contractors
7. CMS, NPI Fact Sheet (December 2024) — an NPI does not ensure licensure; NPPES data is self-reported
8. Federation of State Medical Boards, Contact a state medical board (directory of all state medical and osteopathic boards) — state medical boards and their license searches
9. NCSBN, Nursys: License verification (“Licensure QuickConfirm is a free service”; e-Notify alerts) — free nurse license verification and e-Notify alerts
10. ABMS, Certification Matters (board certification search) — verifying board certification for ABMS member boards

Checked October 27, 2026. This page is general information, not legal advice. Credentialing requirements depend on your state, payers and accreditor; follow their current standards. Examples use invented people and practices.