Credentials file review: what a surveyor asks you to produce, and who signed it

"Show me where the governing body granted privileges to these four."

The request comes twenty minutes into the Medical Staff Credentialing and Privileging session. The surveyor has the bylaws and the Medical Executive Committee minutes open, with four practitioner names on a pad.

What follows is a pause. All four hold current licenses and were verified before appointment. The question on the table is narrower than that, and it is about the record: which document, in which file, shows the board acting, and on what date.

That pause is what a credentials file review produces when the trail sits in more places than one person can reach quickly. The review is a named activity with published instructions, one of the few parts of a survey you can prepare for line by line.

What the 2026 Survey Process Guide tells a surveyor to do with a credentials file

Effective January 1, 2026, the Joint Commission replaced the Survey Activity Guide with the Hospital Accreditation Survey Process Guide for the hospital and critical access hospital programs. It runs to 709 pages and aligns with the Medicare State Operations Manual. It is the guide the surveyor in the room works from.

The guide lists the methods a surveyor uses, and credentials files are one of them: "Direct observation, interviews with staff and patients, medical record review, performance data review, personnel file and credentials file review, other documentation". Under document review, the instruction is to examine credential files to determine "if the facility complies with CMS requirements and State law, as well as, follows its own written policies for medical staff privileges and credentialing".

Medical Staff Credentialing and Privileging is a named survey activity with named participants: the president of the medical staff, the medical director and medical staff coordinator where those roles exist, and credentials committee representatives. The surveyor evaluates the process used to collect data relevant to appointment decisions, how privileges are granted and delineated, and the structures that keep implementation consistent, such as bylaw requirements. The guide states that this will include credentials and privileges file review, and the files reviewed are reported out at the daily surveyor team meeting.

A credentials file review is where the governing body gets tested

The most useful sentence in the guide sits in the Governing Body Evaluation Module, at 42 CFR 482.12(a)(2). Under document review, credential file, the surveyor instruction reads: "Review records of medical staff appointments to determine that the governing body is involved in appointments of medical staff members."

Read that as a governance test run on a credentialing artifact. The Condition of Participation at 482.12(a)(2) requires the governing body to "Appoint members of the medical staff after considering the recommendations of the existing members". At 482.12(a)(5) the board must ensure the medical staff is accountable to it for quality of care, and the surveyor's instruction there is a credentials file review, checking that anyone providing patient care is a member of the medical staff or accountable to one.

For a board member, that changes where the exposure sits. A finding at 482.12(a) lands on the governing body, because the CFR places that duty on the board, and the evidence comes out of a file the medical staff services office maintains.

714 requirements were removed without changing what you must document

Accreditation 360 took effect on January 1, 2026. In the Joint Commission's own words, from its June 30, 2025 announcement: "Building on the reduction of 400 requirements announced in 2023, Joint Commission is removing an additional 714 requirements from the hospital accreditation program."

The Accreditation 360 FAQs address documentation directly. There are no new documentation expectations, and the survey process used to evaluate compliance has not changed. The accreditation cycle remains triennial. The Joint Commission's accreditation process page puts the unannounced full survey at between 30 and 36 months after the previous one, and 24 months for laboratories.

The numbering did change, and it matters to anyone maintaining written policy. Every Medical Staff standard was renumbered effective January 1, 2026. Credentials and primary source verification is now MS.17.01.03. The three-year privileging period moved to MS.18.02.03. Policies and delegated agreements drafted before 2026 cite numbers that no longer exist, and a surveyor asking you to follow your own written policy will be reading those documents.

The record has to show two decisions in the right order

Appointment and privileging are two acts by two bodies. The medical staff examines the credentials of eligible candidates and makes a recommendation to the governing body, under 42 CFR 482.22(a)(2). The governing body then appoints, having considered that recommendation. A file that holds excellent verification evidence and no committee recommendation, or a recommendation with no board action recorded against it, does not show the sequence the CFR describes. For each of the four names on the surveyor's pad, that is two dated entries and an order between them, held in two separate sets of minutes. A credentials file review has to show both.

Dates carry as much weight as the documents. The NAMSS Ideal Credentialing Standards, published January 2024, set thirteen essential criteria for initial credentialing and state that medical services professionals "should primary-source verify all information to support the following 13 criteria within 180 days prior to the credentialing decision". A verification with no recorded date cannot be shown to fall inside that window.

Where the three-year privileging period actually comes from

42 CFR 482.22(a)(1) reads, in full: "The medical staff must periodically conduct appraisals of its members." No numeric interval appears anywhere in 482.22. The three-year ceiling comes from the Joint Commission, at MS.18.02.03, which carries the note that privileges are granted for a period not to exceed three years or the period required by law and regulation if shorter.

That distinction has practical consequences at survey. The Medical Staff Evaluation Module at 482.22(a)(1) sends the surveyor to interview and document review, to determine whether the medical staff has a system for reappraising each current member at regular intervals and whether the bylaws identify the process and criteria for the periodic appraisal. Bylaws that attribute a three-year cycle to CMS name an authority that did not set it, and the surveyor reads those bylaws to check you follow them.

NCQA set the annual delegated file audit

Delegated credentialing carries two obligations that often get merged.

CMS, at 42 CFR 422.504(i)(4)(iii) and (i)(4)(iv)(B), requires that performance is monitored by the Medicare Advantage organization "on an ongoing basis", and that a delegated credentialing process is audited on an ongoing basis. The regulation sets no annual cadence. The annual file audit and the annual evaluation come from NCQA's delegation guidance for health plans, alongside predelegation evaluation completed no earlier than twelve months before delegation begins and at least semiannual reporting by the delegate.

An arrangement built on an annual rhythm satisfies the NCQA requirement and leaves the CMS duty unmet, because twelve months of silence is not ongoing monitoring. The evidence that closes that gap is a dated activity log between the audits.

Each practitioner's trail, spread across three systems

Go back to the four names on the pad. For each one the verification lives in the credentialing system and the recommendation in credentials committee minutes, while the board action taken on that recommendation sits in governing body minutes. Producing the four files means opening three systems and matching each practitioner to a dated entry in each as the surveyor waits. Two of the four go quickly. The third has a recommendation dated after the board action, which somebody now has to explain. The fourth had privileges granted at a meeting the current coordinator did not attend.

Credentially has worked on that assembly problem since 2017. Automated primary source verification records the source and the date against the practitioner's record at the moment it happens, and electronic signature and form fill run under a single audit trail, with the person and the timestamp on every action. Audit reporting then draws from the log itself rather than from a reconstruction, and role-based access governs who can see and change what. The same reporting shows which stage each file is sitting at, which is how a bottleneck becomes visible before it becomes a finding.

The same four files come out differently when the board action, the recommendation and the verification are all logged with a date and a person. The coordinator filters to the four names and reads out the issuing source and date on each verification, then the committee and board dates on each practitioner's record. The sequencing question on the third practitioner is answered by the record itself, because the entries sit in the order they were made rather than the order they were retrieved.

What your office should be able to produce without notice

The Survey Process Guide notes that its published document list does not cover everything a surveyor may request, and that additional documents can be asked for at any point to explore or validate what the team has seen or heard. Everything past that list gets produced under the clock, and a credentials file review rarely stops there. The credentialing ROI calculator prices the credentialing administration behind those files.

Test the office against the harder version. Take four practitioners you did not pick in advance, and for each one produce the primary source verification with its date and issuing source, the medical staff recommendation with the committee date, the governing body action that granted the privileges with the meeting date, and the current delineation of privileges with its expiration date. The guide's document list also expects the last twelve months of governing body minutes, and the bylaws with every change since the last full survey flagged for the survey team. The list of employees with name, position and primary work location is due by the end of day one.

‍

References

1. Joint Commission, Hospital Accreditation Survey Process Guide, copyright 2026, changes effective January 1, 2026. https://digitalassets.jointcommission.org/api/public/content/64731897e3d94ca69e54042c2e27d9c6?v=19446f24 (retrieved August 5, 2026)
2. Joint Commission, Joint Commission Launches a Transformative Approach to Healthcare Accreditation, June 30, 2025. https://www.jointcommission.org/en-us/knowledge-library/news/2025-06-joint-commission-launches-a-transformative-approach-to-healthcare-accreditation (retrieved August 5, 2026)
3. Joint Commission, Accreditation 360: The New Standard FAQs. https://www.jointcommission.org/en-us/accreditation/accreditation-360/faqs (retrieved August 5, 2026)
4. Joint Commission, Accreditation Process, source of the 30 to 36 month full survey interval. https://www.jointcommission.org/en-us/accreditation/process (retrieved August 5, 2026)
5. 42 CFR 482.12, Condition of participation: Governing body. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/xml/CFR-2024-title42-vol5-sec482-12.xml (retrieved August 5, 2026)
6. 42 CFR 482.22, Condition of participation: Medical staff. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/xml/CFR-2024-title42-vol5-sec482-22.xml (retrieved August 5, 2026)
7. 42 CFR 422.504, Contract provisions, including (i)(4). https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol3/xml/CFR-2024-title42-vol3-sec422-504.xml (retrieved August 5, 2026)
8. NCQA, Making the Most of Your Delegation: Practical Guidance for Health Plans. https://wpcdn.ncqa.org/www-prod/wp-content/uploads/NCQA1224-PracticalGuidance-HealthPlans-Toolkit-WEB.pdf (retrieved August 5, 2026)
9. NAMSS, The Ideal Credentialing Standards for Initial Practitioner Applicants, January 2024. https://www.namss.org/Portals/0/NAMSS_1260700-23_ICS_Document_UpdateFINAL%20(1).pdf (retrieved August 5, 2026)