Where facility-specific credentialing requirements come from

There is a spreadsheet open beside the credentialing system. It carries one tab for each client facility, and it holds the items that system has no field for. One hospital wants a tuberculosis screening dated within the past twelve months. Another will not let a clinician into its procedure area without a moderate sedation competency signed off by a department chair. One person maintains that spreadsheet, and the scheduling system that puts clinicians on shifts has never read it.

Facility-specific credentialing requirements are the part of a file that no accreditor wrote. They are enforceable anyway, because the organization that writes a requirement is the one that reviews the file against it.

What the accreditors settle

Hospitals work to Joint Commission standard MS.17.01.03, "Supporting information", where credentials verification sits at EP 3. Accreditation 360 renumbered every Medical Staff standard effective January 1, 2026, and the accreditor's account of the change presents the expectations behind the standards as unchanged.

For health plans the equivalent is the NCQA CR standards, where CR 3 specifies the verification file element by element. On an initial file, the NAMSS Ideal Credentialing Standards of January 2024 ask medical services professionals to primary source verify 13 named criteria inside the 180 days before the credentialing decision.

Between them, those three settle what has to be verified and which source counts as acceptable evidence. None of them says what a given hospital requires of a given role.

Federal rule requires the criteria to exist and leaves the content to the hospital

42 CFR 482.22 opens by requiring that the hospital "have an organized medical staff that operates under bylaws approved by the governing body". The bylaws then carry two obligations that decide who qualifies and for what.

Under 482.22(c)(4), the bylaws must "Describe the qualifications to be met by a candidate in order for the medical staff to recommend that the candidate be appointed by the governing body". Under 482.22(c)(6), they must "Include criteria for determining the privileges to be granted to individual practitioners and a procedure for applying the criteria to individuals requesting privileges".

Neither paragraph says what those qualifications or those criteria should be. Joint Commission covers the same territory at MS.14.01.01 for bylaws requirements and at MS.16.01.01 EP 3 for the scope of privileges, and leaves the content in the same place. Two hospitals accredited by the same body and surveyed against the same standards can hold different criteria for the same procedure and both be compliant. Facility-specific credentialing requirements are a product of that design.

Infection prevention requirements are written locally too

The same pattern runs through infection prevention. Under 42 CFR 482.42 the hospital must have active programs for infection prevention and control, and those programs "must demonstrate adherence to nationally recognized infection prevention and control guidelines". The operating detail sits one level down, in that program "as documented in its policies and procedures".

Each organization's own documented policies settle which screening applies to which category of staff, and how often it has to be repeated. A staffing firm supplying four health systems collects a different answer from each, and has to hold them all at once.

Health plans add a layer, and states add one above that

Medicare Advantage organizations work from 42 CFR 422.204, which requires "written policies and procedures for the selection and evaluation of providers" and a documented process behind them. For providers other than physicians and other health care professionals, that process has to determine that each one is "Reviewed and approved by an accrediting body, or meets the standards established by the organization itself". The plan is permitted to write its own standard.

Medicaid managed care goes further. Under 42 CFR 438.214(b)(1), "Each State must establish a uniform credentialing and recredentialing policy" covering acute, primary, mental health, substance use disorder and long-term services and supports providers as appropriate, and each plan must follow it. Paragraph (e) is one sentence long: "Each MCO, PIHP, and PAHP must comply with any additional requirements established by the State".

Where credentialing is delegated, the requirement set lands in the agreement. NCQA's September 2025 guide defines delegation as one organization giving another the authority to perform an activity it would otherwise perform itself, and holds the delegating organization responsible throughout. It advises that the delegation agreement "clearly identifies the responsibilities of both delegate and health plan". A credentialing operation covering plans in more than one state holds several requirement sets at once, each of them written somewhere other than an accreditation manual.

The governing body keeps the responsibility and passes down the requirement

The governing body's position on contracted services is set at 42 CFR 482.12(e): "The governing body must be responsible for services furnished in the hospital whether or not they are furnished under contracts". The same paragraph requires the governing body to ensure that a contractor "furnishes services that permit the hospital to comply with all applicable conditions of participation and standards for the contracted services".

A hospital cannot hand that responsibility to a staffing partner, so it passes down the requirement that discharges it. The facility-specific credentialing requirements a staffing firm receives are downstream of that sentence, which is also why they arrive as contract terms and client policies rather than as accreditation standards.

A requirement added on September 1

The shape of it is easiest to see at one firm with 58 clinicians assigned to a single health system. That system opens a new procedure area, its medical executive committee approves privileging criteria for it, and the criteria take effect September 1, 2026. Those criteria come from the same bylaws that 482.22(c)(6) requires, and the new privilege brings an evaluation with it under MS.18.02.01, which covers criteria and triggers for evaluating performance.

The requirement reaches the firm as an email attachment and moves into the spreadsheet the same afternoon. On September 3 two clinicians are scheduled into the unit without the competency documented anywhere the scheduler can see. The health system's own file review finds it, and the firm's clinicians are pulled from that unit for 11 days while evidence is gathered and verified for the whole cohort.

Both clinicians were qualified, and the evidence for that sat where the scheduling decision could not reach it. The break was in the route the requirement took from an email attachment to a scheduling rule.

Building a facility-specific credentialing requirement into the record

The cost of all this shows up as one number: the days between a requirement arriving and the last affected clinician being asked for the evidence. In an operation running on email and a spreadsheet, that number is however long it takes one person to work through a roster by hand, and it is invisible to everyone else until a client review exposes it.

Shortening it is a configuration problem. In Credentially, a verification check is a configurable item, so a requirement written by one hospital can be set up the same way a state license is: an evidence type that satisfies it and a date on which it lapses. The check is then scoped to the client facility that asked for it, and narrowed to a single role where only some of the clinicians there are covered. Documents supplied against it are classified on upload and the data extracted, and the lapse date sits on the practitioner record, where compliance monitoring raises an alert before it passes. Where a required check is unmet, the clinician can be blocked from booking shifts.

Run September 1 the other way and it costs an afternoon. The check is created for that health system and that role, and all 58 records are tested against it. Automated reminders then chase the clinicians whose evidence is missing. The file review in the second week of September reads from a record showing, for each clinician, whether the check is held and on what date it was accepted.

All of that has a limit. A competency written by a hospital has no primary source outside the hospital that wrote it, so the record holds the evidence and the date on it, together with the name of whoever accepted it. That is what a client file review asks to see, and it is all there is to hold. Automated primary source verification covers the credentials with a source register behind them, and a locally authored competency is not one of them.

What to ask for when a client adds a requirement

Facility-specific credentialing requirements are easiest to absorb before they reach a system at all. When a health system or a health plan adds one, ask for it in writing with an effective date and a defined evidence type. Then ask what renewal interval it carries, because a requirement that renews needs a permanent place in the record. A requirement that arrives as prose in an email becomes somebody's spreadsheet inside a week.

‍

References

1. The Joint Commission, Accreditation 360, Updated Accreditation Manual: Nursing and Medical Staff chapters, on-demand webinar deck, copyright 2025. Source for MS.14.01.01, MS.16.01.01 EP 3, MS.17.01.03 EP 3, MS.18.02.01, the January 1, 2026 renumbering and the statement that expectations remain unchanged. https://digitalassets.jointcommission.org/api/public/content/67fa88563061453bb0cad9614ddc63a3?v=78b74a1c
2. 42 CFR 482.22, Condition of participation: Medical staff, 42 CFR chapter IV, 10-1-24 edition, US Government Publishing Office. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/pdf/CFR-2024-title42-vol5-sec482-22.pdf
3. 42 CFR 482.12, Condition of participation: Governing body, same edition. Source for paragraph (e) on contracted services. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/pdf/CFR-2024-title42-vol5-sec482-12.pdf
4. 42 CFR 482.42, Condition of participation: Infection prevention and control and antibiotic stewardship programs, same edition. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/pdf/CFR-2024-title42-vol5-sec482-42.pdf
5. 42 CFR 422.204, Provider selection and credentialing, 42 CFR chapter IV, 10-1-24 edition. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol3/pdf/CFR-2024-title42-vol3-sec422-204.pdf
6. 42 CFR 438.214, Provider selection, 42 CFR chapter IV, 10-1-24 edition. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol4/pdf/CFR-2024-title42-vol4-sec438-214.pdf
7. NCQA, A Comprehensive Guide to NCQA Credentialing Programs, September 2025. Source for the definition of delegation and the delegation agreement guidance. https://wpcdn.ncqa.org/www-prod/NCQA-Credentialing-eBook-2025.pdf
8. NCQA, Health Plan Accreditation standards updates, CR 1 to CR 9 structure and CR 3 Credentialing Verification elements. https://wpcdn.ncqa.org/www-prod/wp-content/uploads/HPA-2025_Proposed-Standards-Updates.pdf
9. NAMSS, The Ideal Credentialing Standards for Initial Practitioner Applicants, January 2024. https://www.namss.org/Portals/0/NAMSS_1260700-23_ICS_Document_UpdateFINAL%20(1).pdf