What a complete credentialing file actually contains

An internal medicine physician's credentialing file goes to a health plan credentialing committee looking complete and comes back marked incomplete over a single line: board certification.

The certification is genuine and current with an ABMS member board. The evidence in the credentialing file is a printout from the ABMS consumer lookup, the page published for patients checking their own doctor, which NCQA does not accept as a verification source. It arrived with the application pack and was filed as the verification. That verification has to be run again against the specialty board, and the decision date moves. A document already in the file sent it back, on the strength of where it came from.

A credentialing file is several lists laid on top of each other, each with its own rule about where the evidence comes from and how recent it has to be at the decision.

One credentialing file, three separate rulebooks

For hospitals, credentials verification sits at Joint Commission standard MS.17.01.03, titled "Supporting information". Every Medical Staff standard was renumbered under Accreditation 360 effective January 1, 2026, and the Joint Commission's crosswalk maps credentials verification onto MS.17.01.03 EP 3. A policy document that still carries the old numbering is citing a retired standard.

The file is where critical access hospitals lose points. In Joint Commission survey data covering May 1, 2024 to May 31, 2025, credentials verification appears among their top five Medical Staff opportunities for improvement. The other four concern bylaws compliance, OPPE and FPPE. Credentials verification is the only entry about the file's contents.

CMS sets the outer boundary and nothing more. Under 42 CFR 482.22(a)(2) the medical staff examines the credentials of eligible candidates and recommends appointment to the governing body, and 482.22(a)(1) requires it to appraise members "periodically", with no interval attached.

Health plan credentialing runs on the NCQA CR standards, CR 1 through CR 9. CR 3, Credentialing Verification, specifies the file element by element. A physician joining a health system that also runs its own plan network sits inside two of those rulebooks at once, with one file expected to satisfy each.

Only the original source counts for these items

CR 3 opens with the general rule that the organization verifies credentialing information through primary sources unless otherwise indicated, and that duty does not move. A practitioner who supplies a clean copy of their own license has not discharged any part of it, and the credentialing file should show where the check went and what came back.

For licensure, the check goes directly to the state licensing or certification agency or its website, in every state where the practitioner provides care to members. Education and training come from the primary source, or from one that itself primary source verifies them.

NCQA does not require board certification. Nothing in the file prompts the verification until a practitioner claims it. Once claimed, it must be evidenced like anything else, and the expiration date is recorded. Acceptable sources include the relevant specialty board, the AMA Physician Masterfile, an official ABMS display agent, and a state licensing agency that primary source verifies it. The consumer-facing ABMS lookup is excluded by name.

The file recorded the source as ABMS, which was accurate as far as it went. An official ABMS display agent is on the acceptable list, and the consumer lookup shows the same certification. A source line reading "ABMS" does not record which ABMS source was used.

Five-year lookbacks with different sources

The work history lookback runs five years under CR 3, taken straight from the practitioner's application or CV. The practitioner has to clarify any gap beyond six months, and to put the explanation in writing where the gap is longer still.

The malpractice lookback also runs to five years of settlements, taken from the carrier or from an NPDB query, and may include residency or fellowship years. Current coverage is evidenced by attestation, or by a face sheet or certificate in the file.

Dates entered as "2023 to 2024" have to resolve to months before a six-month gap shows up.

DEA registration takes a separate check in each state

NCQA applies a per-state rule to DEA or state controlled dangerous substances registration, which must be valid and current in every state where the practitioner provides care. Accepted sources include the DEA or the issuing state agency, the certificate or a photocopy of it, a documented visual inspection of the original, and the state pharmaceutical licensing agency.

DEA is the one verification where a photocopy counts as evidence in its own right. Where a DEA-eligible practitioner holds no certificate, the file must say so and name an alternate prescriber, or carry the practitioner's written statement that they do not prescribe controlled substances, together with how they handle patients who need them.

NPDB and exclusion checks run on their own clock

Only hospitals are federally mandated to query the NPDB. The query is required when a practitioner applies for appointment or clinical privileges, including temporary privileges. It is required again on any request to expand privileges, and every two years on everyone holding membership or privileges.

That two-year mandate does not bend to fit the accreditation cycle. NCQA requires formal recredentialing at least every 36 months and Joint Commission privileging runs on a three-year period, so a hospital on a three-year cycle still owes a query in the intervening year, which the NPDB Guidebook confirms.

Between cycles, NCQA CR 5 requires ongoing monitoring of sanctions, complaints and quality issues. Sanction information is reviewed within 30 calendar days of release by the reporting entity, and adverse event monitoring runs at least monthly.

Monthly is also the cadence at the HHS Office of Inspector General, which updates its List of Excluded Individuals and Entities and recommends screening employees and contractors as often. Between the mandated queries, organizations can enroll practitioners in NPDB Continuous Query at $2.50 per practitioner a year.

Shelf life: how old a verification may be on the decision date

Every verification carries a date, and how old that date may be differs by item and by program. NCQA publishes the limits as a table in its September 2025 guide for Credentialing Accreditation and for Credentialing Certification. A license verification may be up to 180 days old under Accreditation and 90 under Certification.

Board certification and malpractice history both run to 120 and 90 days, a pair shared by the state licensing sanctions and the Medicare and Medicaid checks. That pair is the tightest in the table. Work history and the application attestation hold 180 days like the license, and keep 120 under Certification where the license drops to 90.

A file assembled under those programs can therefore reach the committee with every item present and its oldest verification already outside its window. What such a committee approves is a set of verifications, every one of them still inside its limit on the decision date.

Verifying board certification again resets one date, and every other verification in the file keeps aging while that happens. In Credentially, the credentialing record date-stamps each verification as it is logged. The file's oldest verification is visible without reconstruction. The window it has to sit inside belongs to the standard.

Document intake decides how much you find late

The board certification error was made at intake, long before anyone reviewed the credentialing file. Intake settles something else too: whether an expiration date is captured at all. A certificate arrives as a phone photograph named IMG_4471 and is filed under that name. Someone retypes CV dates into a form, or leaves them buried in the PDF.

A document uploaded from a phone is classified on arrival, and its data extracted, including handwritten text. Parsing pulls the CV dates into structured fields. An employment gap shows while the practitioner is still filling out the form. Primary source verification is automated where an integration exists, and the platform tracks expirations without standing in for the query obligations above.

The board certification item surfaces at a different moment on that route. The printout is filed as board certification evidence and the verification logged against the exact source it came from, so the record names the consumer lookup instead of ABMS in general. Whoever opens the file next reads that source line, and the re-verification is raised before the file leaves intake, with no other verification yet date-stamped. None of that makes the specialty board answer any sooner. The question is asked early enough that the answer arrives before the committee date, and the decision holds.

Four checks to run against your own credentialing files

Pull the last ten files your team completed.

First, measure the gap between the earliest verification date in each file and the date the committee approved it, then check every verification against the window that applies to that item, starting with the 120 and 90 day items. Any file where a verification aged out ahead of approval is a finding waiting to be made.

Second, check where DEA expiration dates live. The photocopy satisfies the verification; surfacing the date is a separate job. If the date exists only on a scanned certificate, with no field to trigger an expiration alert, a payer or a surveyor finds the lapse before you do.

Third, for every verified item, confirm the file names the source, the date and the person who ran it. Any item tracing back to a source outside the ones acceptable for it gets the re-verification booked now.

Fourth, look at how the work history dates got into the file, and whether anyone reconciled the application form against the CV it was typed from.

Anything you cannot answer from the credentialing file itself needs closing before the next recredentialing cycle.

‍

References

1. The Joint Commission, Accreditation 360, Updated Accreditation Manual: Nursing and Medical Staff chapters, on-demand webinar deck, copyright 2025. https://digitalassets.jointcommission.org/api/public/content/67fa88563061453bb0cad9614ddc63a3?v=78b74a1c Source for MS.17.01.03 "Supporting information", the January 1, 2026 renumbering, the credentials verification crosswalk to EP 3, and the top-five Medical Staff opportunities for improvement at critical access hospitals using survey data from May 1, 2024 to May 31, 2025.
2. 42 CFR 482.22, Condition of participation: Medical staff, 42 CFR chapter IV, 10-1-24 edition, US Government Publishing Office. https://www.govinfo.gov/content/pkg/CFR-2024-title42-vol5/pdf/CFR-2024-title42-vol5-sec482-22.pdf
3. NCQA, Health Plan Accreditation standards updates, source for the CR 1 to CR 9 structure, the CR 3 Credentialing Verification elements, the CR 4 recredentialing cycle and the CR 5 ongoing monitoring requirements. https://wpcdn.ncqa.org/www-prod/wp-content/uploads/HPA-2025_Proposed-Standards-Updates.pdf Element titles and substance only, corroborated by the September 2025 guide at reference 5.
4. NCQA, Credentialing Accreditation program scope. https://www.ncqa.org/programs/health-plans/credentialing/benefits-support/standards/
5. NCQA, A Comprehensive Guide to NCQA Credentialing Programs, September 2025. https://wpcdn.ncqa.org/www-prod/NCQA-Credentialing-eBook-2025.pdf Source for the verification currency windows under Credentialing Accreditation and Credentialing Certification.
6. NCQA, NCQA's Credentialing Standards Help Ensure Safety and Integrity of Practitioner Networks, November 19, 2024. https://www.ncqa.org/blog/ncqas-credentialing-standards-ensure-safety-and-integrity-of-practitioner-networks/
7. National Practitioner Data Bank, Hospitals. https://www.npdb.hrsa.gov/orgs/hospitals.jsp
8. National Practitioner Data Bank, Guidebook, Chapter D: Queries, Overview. https://www.npdb.hrsa.gov/guidebook/DOverview.jsp
9. National Practitioner Data Bank, Continuous Query. https://www.npdb.hrsa.gov/hcorg/pds.jsp Source for the $2.50 annual enrollment charge.
10. HHS Office of Inspector General, LEIE Database and Supplement Downloads. https://oig.hhs.gov/exclusions/exclusions_list.asp
11. HHS Office of Inspector General, Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs, May 8, 2013. https://oig.hhs.gov/exclusions/files/sab-05092013.pdf