Medical Staff Credentialing: The Process Explained

A new physician accepts an offer, agrees on a start date, then waits. The medical staff office is still verifying a residency completion, chasing a slow response from a state board, and holding an application that arrived missing two required data elements. The start date slips by three weeks, and the department covers the gap with locum shifts.

That sequence describes the everyday work of medical staff credentialing, the process of collecting and verifying a provider's qualifications before they treat patients or bill for care. Credentialing is a chain of dependent steps: application, primary source verification, committee review, then a governing-body decision.

This guide sets out what credentialing covers, the process steps in order, how privileging fits alongside it, and the standards that CMS, The Joint Commission, and NCQA each apply. It is written for medical staff services professionals, credentialing specialists, and anyone in a medical staff office who owns the timeline and answers for it at audit.

What medical staff credentialing is, and where it stops

Medical staff credentialing is the verification that a provider holds the education, training, licensure, and work history they claim. The core of it is primary source verification, meaning each credential is confirmed with the body that issued it rather than accepted from a copy the applicant supplies.

Credentialing supports patient safety, since it keeps unqualified or sanctioned providers out of clinical roles. It underpins accreditation, because accrediting bodies require documented verification. Reimbursement eligibility depends on it too, given that payers and Medicare participation both require a credentialed medical staff.

Credentialing answers whether a provider is qualified. Privileging, covered below, decides what the provider may do within the facility. Credentialing is also distinct from payer enrollment, the process of registering a provider with health plans so claims can be paid.

The regulatory backbone sits in the Medicare Conditions of Participation. Under 42 CFR 482.22, the organized medical staff must examine the credentials of each applicant and make recommendations to the governing body, working within the scope of practice permitted by state law and the medical staff bylaws (eCFR, current). Credentialing is the mechanism that produces those recommendations.

The medical staff credentialing process steps, from application to board approval

The credentialing process moves through six working stages. They group the underlying tasks a medical staff office tracks, and they run in this order.

Application and data collection. The provider submits an application covering identity, education, training, licensure, board certification, work history, malpractice history, and references. NAMSS sets out the essential data elements a complete file should contain, and an application missing any of them cannot progress cleanly to verification (NAMSS Ideal Credentialing Standards). Completeness at this stage sets the pace for everything that follows.

Primary source verification. Each credential is confirmed directly with the issuing source or an approved equivalent, such as a Designated Equivalency Source. Many organizations route this work through a credentials verification organization. NAMSS revised its Ideal Credentialing Standards in 2024 to sharpen primary source verification expectations and add clarity for telehealth and locum tenens providers (NAMSS Ideal Credentialing Standards, 2024). This is the most labor-intensive stage, because a single provider file can require outreach to a dozen separate sources.

Credentials committee review. The verified file goes to the credentials committee, which examines it and forms a recommendation. Managing that file, the verification outreach, and the committee cycle is the day-to-day work of medical staff services.

Medical executive committee recommendation. The credentials committee passes its recommendation to the medical executive committee, the elected group of physicians that speaks for the organized medical staff.

Governing body approval. The governing body, usually the board, makes the appointment decision. Final authority rests with the board alone, a point 42 CFR 482.22 makes explicit.

Notification. The provider and relevant departments are told the outcome, and the approved start date is confirmed.

Automated primary source verification does the most here, removing the source-by-source outreach that ties up a specialist's week.

Credentialing and privileging in healthcare: how the two decisions differ

Credentialing confirms a provider is qualified. Privileging decides the specific clinical activities they are authorized to perform. A cardiologist can hold a clean, fully verified file and still be granted a defined list of privileges that stops short of procedures outside their trained scope.

Medical staff membership and clinical privileges are separate grants. A provider can hold one without the full extent of the other, and the governing body approves both.

Competency review runs alongside privileging. Focused Professional Practice Evaluation applies when a provider is newly appointed, requests a new privilege, or triggers a specific concern, and it looks closely at performance for a defined period. Ongoing Professional Practice Evaluation runs continuously across the whole medical staff, feeding data back into privilege renewal (The Joint Commission, OPPE standards FAQ).

Evidence gathered during a provider's Focused Professional Practice Evaluation carries into the first reappointment, where the credentials committee weighs that early performance data alongside the verified file rather than starting the review from scratch.

Privileges are not open-ended. The Joint Commission requires that privileges be granted for a period not to exceed three years, or a shorter interval where state law demands it (The Joint Commission, MS.06.01.07 EP 9). That period sets the clock for reappointment.

The standards that govern medical staff credentialing: CMS, Joint Commission, NCQA

Three frameworks shape credentialing in the United States, and they do not line up point for point. Reading them as one blurs where they diverge on cycle length and on who holds the final decision.

CMS sets the federal floor through the Conditions of Participation. Any hospital that participates in Medicare must meet 42 CFR 482.22, which requires medical staff examination of credentials and a governing body decision (eCFR, current; NAMSS Conditions of Participation summary).

The Joint Commission accredits hospitals and can confer deemed status for Medicare, and its Medical Staff standards govern the credentialing and privileging cycle in detail. NCQA sets credentialing standards for health plans, and its full-scope requirements include primary source verification, a credentials committee, and ongoing monitoring between cycles (NCQA, credentialing standards).

The table below maps where the three diverge.

RequirementCMS (42 CFR 482.22)The Joint CommissionNCQAApplies toMedicare-participating hospitalsAccredited hospitals and systemsHealth plans and their networksRecredentialing cycleSet by medical staff bylawsNot to exceed 3 yearsEvery 36 monthsPrimary source verificationRequiredRequiredRequiredOngoing monitoring between cyclesNot specifiedRequired through OPPERequiredFinal authority on appointmentGoverning bodyGoverning bodyHealth plan credentialing committee

The practical takeaway is that a health system holding both Joint Commission accreditation and health-plan contracts runs to two clocks at once, and a single provider file often has to satisfy all three sets of rules.

How long medical staff credentialing takes, and where it stalls

Credentialing routinely adds 90 to 120 days or more before a provider can start, and delay carries a revenue cost because a provider who cannot be credentialed cannot bill. MGMA has reported that credentialing-related denials were rising for medical groups, with more than half of practices reporting an increase in a 2021 MGMA Stat poll (MGMA, 2021). Denials tied to credentialing convert a workflow delay into lost collections.

The bottleneck sits in four places: application completeness, verification turnaround, committee meeting cadence, and the board approval cycle. Software addresses the first two directly. Configurable credentialing workflows keep applications complete before they enter verification, and automated primary source verification compresses turnaround. It does not move a committee that meets monthly or a board that meets quarterly.

Staffing agency Health Carousel used automated primary source verification to expand credentialing capacity without adding headcount and to compress audit preparation (Credentially, Health Carousel case study). Candidates could track their own progress through the file, so a provider who can see what is outstanding chases their own paperwork instead of waiting on a phone call.

Centralized document management does further work between decisions. A platform that tracks every license, certification, and expiration with automated reminders keeps files audit-ready rather than reconstructed under pressure. Credentially adds real-time compliance monitoring on top, running monthly license checks and OIG and SAM exclusion screening so a lapse surfaces the day it happens rather than at the next reappointment.

Reappointment is credentialing on a repeating cycle. NCQA requires recredentialing every 36 months from the last approval. The Joint Commission moved its reappointment interval from two years to a period not to exceed three years under MS.06.01.07 EP 9, aligning the hospital cycle more closely with health-plan recredentialing, though some states still set a shorter interval that a medical staff office must apply on top of the accreditation standard.

The National Practitioner Data Bank fits this cycle as a point-in-time query rather than a live feed. Hospitals are federally required to query the NPDB when a provider is appointed and every two years thereafter, and hospitals are the only entities carrying that federal mandate (NPDB, What You Must Report). Its public dataset spans reports from September 1, 1990 onward, which gives an indication of how deep the report history behind a single query can run (NPDB, Public Use Data File).

Getting the timeline under control

The place to tighten the timeline is at the front. Application completeness and primary source verification are the stages a medical staff office can influence most, while committee and board cadence set a floor that process design works around rather than beats. A file still moves at the speed of its slowest verification, so the earliest stages decide whether the timeline holds.

For a fuller walk through file setup, verification, and reappointment, read our medical staff credentialing guide, which covers each stage in more depth and links out to the underlying standards. It is a useful reference to keep beside the process when you are mapping your own credentialing timeline and deciding where to tighten it.