Credentialing should be a feed, not a 3-year file review. Today most health plans work on a calendar. A clinician is credentialed when joining the network and recredentialed every 36 months, with a few list checks in between. Medicare Advantage rules require recredentialing at least every 3 years, and NCQA’s standards follow the same cycle. Medicare’s own enrollment process works on a similar clock, with most providers revalidating every 5 years and suppliers of durable medical equipment every 3.
The facts that matter do not follow a calendar. A license lapses on a Tuesday, or a state board restricts a license in the middle of a quarter. A credentials file reviewed every 3 years is a record of what was true on the day someone last looked.
The calendar is not the risk
The industry has been moving toward more frequent checks. Under NCQA’s credentialing standards that took effect in July 2025, accredited organizations must monitor each network clinician at least every 30 days for exclusions and sanctions, with the federal System for Award Management added as a source. The same update shortened the window for verifying credentials before a decision from 180 days to 120, which we covered in January.
Monthly monitoring is a real improvement over checking once every 3 years. It is still a batch. A check that runs on the first of the month learns about an exclusion posted on the second about 4 weeks later. During those weeks, claims keep flowing and the clinician keeps appearing in the directory.
Those weeks have a cost. Federal health care programs generally do not pay for items or services “furnished, ordered, or prescribed” by an excluded individual. A plan that learns of an exclusion late may find that claims it paid in the meantime have to be identified and recovered, and that members were sent to a clinician who should not have been in the network.
Meanwhile, many of the sources already publish closer to real time. The National Practitioner Data Bank’s Continuous Query service sends enrolled organizations an email within 24 hours of a new report on an enrolled practitioner. State licensing boards post actions as they take them, and many offer alerts or data files. The federal exclusion lists update on their own schedules, not the plan’s.
The mismatch is the point. The information arrives as events. Most credentialing programs receive it as a schedule.
What a feed looks like
A credentialing feed treats each clinician’s record as something that changes whenever a source reports a change, not only when a cycle comes due.
- Subscribe where possible, poll where necessary. Use services that push changes, such as Continuous Query, and compare each new release of a list against the last one rather than re-checking every name from scratch.
- Record every event with its source and time. A board action or an address change becomes an entry in the clinician’s history, with where it came from and when it arrived.
- Route by consequence. An upcoming license expiration needs only a reminder, while a confirmed exclusion needs an immediate hold on payment and network status while the facts are checked.
- Verify identity before acting. Exclusion and sanction lists produce false matches on common names. A feed should flag a possible match quickly and confirm it carefully, with identifiers such as the National Provider Identifier and license number.
- Put the clinician’s own updates in the same stream. A new practice location or hospital affiliation reported by the clinician belongs in the same history as the changes a plan learns from outside sources.
Done this way, recredentialing changes character. When the 36-month date arrives, most of the file is already current, and the committee reviews a history of events rather than a fresh pile of documents. The cycle becomes a confirmation, not a rediscovery.
A credentials file reviewed every 3 years is a record of what was true on the day someone last looked.
There are side benefits. The same events that update a credentials file, such as a new practice location or a change in hospital affiliation, are the events that keep a provider directory accurate. A plan that receives them continuously has fewer reasons to publish a directory that is months out of date.
What changes for the committee
A feed does not remove judgment from credentialing. It changes where judgment is spent. Most events, such as a renewed license or a cleared name match, need no deliberation. A small number need a decision, and those are the ones a credentialing committee should see, with the evidence attached and the time each piece arrived.
The feed also has to be careful about its own power. An automated match against an exclusion list is a lead, not a finding. Acting on a false match can cut a clinician out of a network and leave patients without their doctor. Software can clear a match or confirm a renewal. A decision against a clinician belongs to a person, made on verified facts and recorded with the reasons.
That record matters later. When a regulator or an accreditor asks why a clinician was in the network on a particular date, the answer should come from the event history, which shows what the plan knew and when it acted. A program built on events can answer that question. A program built on periodic file reviews usually has to reconstruct it.
What we build for
We build tools health plans use in utilization review, and credentials show up in that work in 2 places. The first is the clinicians whose requests a plan reviews. The second is the clinicians who make the decisions. Many rules require that denials be made by licensed clinicians with appropriate expertise, and a denial signed by a reviewer whose license lapsed last week is a problem no plan wants to find in an audit.
We think credentials should be treated as live data and checked at the moment they matter, such as when a reviewer signs a decision, not only at the last file review. Every decision we help record should be reconstructable, and that includes the reviewer’s credentials on the day of the decision.
The calendar will not go away. Accreditors and regulators will keep their cycles, and they should. But the cycle should be the moment a plan confirms what it already knows, not the moment it finds out.