NCQA credentialing in 2026 has outgrown the credentialing file. For most of the history of health plan accreditation, a credentialing file was a folder. It held the signed application and printouts from licensing boards and malpractice carriers. The committee’s decision was clipped to the front. Surveyors from the National Committee for Quality Assurance (NCQA) sampled the folders and checked that every page was present and none was too old.
The folder still exists, but the rules around it no longer treat credentialing as a single event. NCQA’s standards now require monitoring at least every 30 days between cycles, and a policy change NCQA released on March 30, 2026 extends that monitoring to every state where a practitioner practices. A separate standard now governs the integrity of the records themselves. States have added clocks of their own. Arizona’s 60-day deadline for completing credentialing took effect April 1, 2026, and West Virginia’s 60-day deadline for Medicaid managed care plans starts July 1. California’s 90-day requirement, signed in October 2025, comes with automatic provisional approval when a plan misses it.
Redlake’s view, at the end, is that the unit of credentialing should be the verified fact, not the file.
Key takeaways
- NCQA’s health plan standards contain 9 credentialing standards. They run from credentialing policies to the oversight of delegates.
- Most verifications can be no more than 120 days old at decision. The limit fell from 180 days in July 2025. The work history limit fell from 365 days to 180, according to an NCQA correction.
- 2026 adds multistate monitoring and accepts compacts. A policy change released March 30, 2026 requires monitoring of sanctions and license limitations in every state where a practitioner practices, and organizations have 90 calendar days to put it in place. A November 2025 clarification accepts licensure compacts when the home-state license was verified with the primary source.
- Federal rules set the floor, not the pace. Medicare Advantage requires recredentialing at least every 3 years, and exchange plans must be accredited on provider credentialing.
- States now set processing deadlines. Arizona and West Virginia give plans 60 days from a complete application, and California gives 90. NCQA’s clock starts somewhere else, at each verification.
- A single practitioner’s record now runs on at least 7 clocks. Each starts at a different event, which is why a folder is the wrong container for it.
What NCQA credentialing requires in 2026
NCQA’s Health Plan Accreditation (HPA) program groups its credentialing requirements into 9 standards, numbered CR 1 through CR 9 in the 2025 standards and carried into 2026. NCQA also runs a separate Credentialing Accreditation program for organizations that credential on behalf of others, and a certification for credentials verification organizations (CVOs), vendors that verify credentials but do not make the decisions. HPA, the program most health plans hold, is the focus here.
| Standard | What it covers |
|---|---|
| CR 1, Credentialing policies | Who is credentialed and on what criteria, with practitioners’ rights to review and correct their information |
| CR 2, Credentialing committee | A peer review body that includes participating practitioners and reviews files that do not meet criteria |
| CR 3, Credentialing verification | Primary source verification of each required credential, plus sanctions checks |
| CR 4, Recredentialing cycle length | Recredentialing at least every 36 months |
| CR 5, Ongoing monitoring and interventions | Checks between cycles for sanctions and complaints, with action when problems appear |
| CR 6, Notification to authorities and practitioner appeal rights | Reporting quality-based suspensions and terminations to the appropriate authorities, and an appeal process for practitioners |
| CR 7, Assessment of organizational providers | Confirming that facilities such as hospitals are in good standing and accredited or assessed on site |
| CR 8, Credentialing information integrity | Protecting credentialing records from inappropriate changes, backed by staff training and an annual audit |
| CR 9, Delegation of CR | A written agreement with each delegate, and audits of the delegate’s work |
Standard titles come from NCQA’s HPA 2025 proposed standards updates and its 2026 HPA policy updates. The descriptions are this analysis’s summary. NCQA’s full standards are licensed documents and were not reviewed in full.
How old a verification can be
The verification standard limits how old each verification may be on the day the decision is made. For most elements, that limit has been 120 calendar days since July 2025, down from 180. Work history is the exception. In its 2025 policy updates, released in November 2024, NCQA corrected the work history limit to 180 calendar days for files processed on or after July 1, 2025, down from 365. The same document required sanction and exclusion checks for all product lines, removing an exception for commercial and exchange products. It also listed the sources NCQA accepts, among them the National Practitioner Data Bank and the HHS Office of Inspector General’s exclusion list.
Our January analysis covered what the 120-day window does to committee schedules and delegated files. The clock measures the age of the evidence, not the speed of the process, so every delay after the first verification counts against it.
How NCQA checks the work
Accreditation surveys review samples of credentialing and recredentialing files. NCQA has long used what it calls an 8/30 method, described in a procedure NCQA published. Reviewers check 8 files, and if any of them fails, they review 22 more, for 30 in all.
The method fits the folder. It confirms that a decision was supportable on the day it was made, not that the plan would notice a license limitation in another state next week.
What changed for 2026 surveys
NCQA revises its standards during each standards year through published updates. Corrections and policy changes must be implemented within 90 calendar days of release unless NCQA says otherwise. The 2026 updates released in November 2025 and March 2026 include 6 credentialing changes.
| Element | Type and date | Change |
|---|---|---|
| CR 5, Element A, factor 3 | Policy change, March 30, 2026 | Monitor sanctions and license limitations in every state where the practitioner practices, including states outside the service area and states where the practitioner does not treat the plan’s members |
| CR 3, Element A | Clarification, November 17, 2025 | Licensure compacts are acceptable if the practitioner’s home-state license was verified with the primary source |
| CR 3, Element B, and CR 5, Element A | Policy change, November 17, 2025 | Revised lists of acceptable sources for Medicare and Medicaid sanctions and exclusions |
| CR 3, Element C, factor 6 | Clarification, November 17, 2025 | Decisions made before July 1, 2025 are not scored on this factor, and the full 12-month look-back applies from January 1, 2026 |
| CR 9, Element A | Correction, November 17, 2025 | Delegation agreements for surveys starting on or after July 1, 2027 must address credentialing information integrity |
| CR 9, Element C, factor 5 | Clarification, November 17, 2025 | Delegate audits may be more frequent than annual, but together they must cover the 12-month look-back |
From NCQA’s 2026 HPA policy updates, released March 30, 2026.
The multistate change carries the most operational weight. Before it, a plan in one state could watch that state’s licensing board and the federal lists. A practitioner who also holds licenses in 3 other states, for telehealth or a second practice, could be disciplined in one of them without the plan noticing. The change closes that gap and multiplies the work, because every license a practitioner holds becomes something the plan checks at least monthly.
The compact clarification reduces work. Several licensure compacts let a clinician practice in member states on the strength of a home-state license. NCQA now accepts that arrangement when the plan has verified the home-state license with the primary source, though under the March change the plan still monitors each state where the clinician practices.
The delegation changes are about time as well. An annual audit that covers only part of the year leaves months unexamined. Requiring audits to cover the full look-back, and agreements to address information integrity from July 2027, pushes plans toward continuous oversight of their delegates.
How the standards sit on federal rules
NCQA accreditation is private, but public programs lean on it. Each program sets its own credentialing requirements. Depending on the program, accreditation can satisfy them or is required outright.
| Program | Credentialing rule | Recredentialing | Role of accreditation |
|---|---|---|---|
| Medicare Advantage | 42 CFR § 422.204 requires written policies and primary source verification, including eligibility for Medicare payment | At least every 3 years, considering performance data | Provider participation rules can be deemed met through approved accreditation under § 422.156 |
| Medicaid managed care | 42 CFR § 438.214 has each state set a uniform credentialing policy | Under the state’s policy | Required by 27 states and accepted by 7 more, by NCQA’s 2020 count |
| Exchange plans | 45 CFR § 156.275 requires accreditation that covers provider credentialing | Under the accreditor’s standards | Required, from NCQA or URAC |
| Original Medicare | 42 CFR § 424.515 governs enrollment, which CMS handles directly | Revalidation every 5 years for most providers | None |
Compiled from the regulations linked above and an NCQA policy page last updated in 2020.
The table leaves out 2 details that matter, one for each of the largest public programs. In Medicare Advantage, deemed status is not a pass, since CMS keeps the authority to validate the accreditor’s work and remove deemed status. When a Medicare Advantage plan delegates credentialing, 42 CFR § 422.504(i)(4) also requires it to review the delegate’s work or to approve and audit the delegate’s process on an ongoing basis. In Medicaid, 42 CFR § 438.602(b) makes the state screen and enroll every network provider. A plan may contract with a provider for up to 120 days while enrollment is pending, then must terminate the provider if enrollment does not follow.
Federal rules say what must be true about a clinician. NCQA says how fresh the evidence must be and how the organization proves it. For a plan that runs public and commercial lines of business, the strictest applicable timing, usually NCQA’s, becomes the operating standard for the whole network.
The state clocks
States have started to regulate a different interval, the time credentialing takes once an application is complete.
| State | Law | Applies to | Deadline | Clock starts | In force | Backstop |
|---|---|---|---|---|---|---|
| Arizona | Laws 2025, ch. 97 (SB 1291) | Health insurers | 60 calendar days | Complete application | April 1, 2026 | In-network claims for services after a complete application, once approved |
| California | AB 1041, ch. 630, Statutes of 2025 | Commercial plans and insurers | 90 days | Completed application | After a 1-year transition | Provisional approval for 120 days |
| West Virginia | HB 4335 | Medicaid managed care plans | 60 calendar days, 1 extension of up to 30 | Clean and complete application | July 1, 2026 | Sanctions, up to credentialing by default |
Each law adds something beyond the deadline. Arizona’s law, approved May 2, 2025, also sets 7-day deadlines for acknowledging an application and for telling the applicant whether it is complete. California’s, approved October 11, 2025, requires the CAQH credentialing form from January 1, 2028 and excludes Medi-Cal managed care plans. Its author described the goal as ending “months-long delays” for physicians joining networks in an announcement. West Virginia’s law, passed February 20, 2026, has the Insurance Commissioner prescribe a standard electronic credentialing form by July 1, 2026, and bars plans from asking for more than the form requires. The state’s enrollment agent gets 5 business days to decide on a complete Medicaid enrollment application.
The state deadlines and NCQA’s verification limit pull in opposite directions. A state clock starts when the application is complete and pushes the plan to finish quickly. NCQA’s clock starts at each verification and limits how stale a fact may be at decision. A plan that verifies early to beat a state deadline spends its NCQA margin while it waits for a missing document. A plan that waits to verify until the file is complete risks the state deadline when a slow source holds things up. The 2 sets of rules are compatible, but only for an operation that knows, for each fact in each file, when it was verified and when it expires.
A single record, 7 clocks
Set NCQA’s rules beside the federal and state ones and a single practitioner’s credentialing record runs on at least 7 clocks, each started by a different event.
| Clock | Interval | Starts at | Set by |
|---|---|---|---|
| Verification age at decision | 120 days for most credentials, 180 for work history | Each verification | NCQA, CR 3 |
| Processing deadline | 60 days in Arizona and for West Virginia Medicaid plans, 90 days in California | Complete application | State law |
| Ongoing monitoring | At least every 30 days, in every state of practice | Last check | NCQA, CR 5 |
| Recredentialing | At least every 36 months, and at least every 3 years in Medicare Advantage | Last decision | NCQA, CR 4, and 42 CFR § 422.204 |
| Provisional Medicaid participation | Up to 120 days | Network provider agreement | 42 CFR § 438.602(b) |
| Medicare enrollment revalidation | Every 5 years for most providers | Last revalidation | 42 CFR § 424.515 |
| Directory verification in Medicare Advantage | At least every 90 days, from plan year 2028 | Last verification | REAL Health Providers Act |
Compiled from the sources cited in this analysis, plus Defacto Health’s summary of the REAL Health Providers Act, enacted February 3, 2026.
A folder can hold the evidence for every one of these clocks, but it cannot run any of them. Each clock needs a date attached to a specific fact. A license verified with a given board on a given day expires for decision purposes on one date and comes due for monitoring on another. When the unit of work is the file, a plan learns that a verification expired when someone opens the folder. When the unit of work is the fact, the expiry is a query that can run every night.
A folder can hold the evidence for every credentialing clock, but it cannot keep time on any of them.
The clocks also explain why credentialing data drifts away from directories, the subject of our March analysis of ghost networks. A plan whose records track each fact’s last verification has most of what a 90-day directory check needs. A plan whose records live in folders verifies the same facts again for a different purpose.
Where credentialing programs fail
NCQA’s own updates and federal oversight point to 6 recurring weak places.
The file waits and its facts expire. Most of a file’s time is spent waiting on someone else, whether a slow primary source or the next committee meeting. Every one of those days counts against the oldest verification. A file that misses a monthly meeting and needs a follow-up question can age out, and the rework lands in front of the next file in line.
Monitoring stops at the state line. The March 2026 change exists because a practitioner’s licenses do not stop at a plan’s service area. Telehealth networks, where a single clinician may hold many licenses, carry the most exposure.
Delegates are seen once a year. Many plans hand credentialing to large medical groups or CVOs, then audit each delegate once a year under CR 9. An annual sample is a slow way to learn that a delegate stopped monitoring in March. Medicare Advantage rules leave the plan responsible regardless of who did the work.
Records change without a trace. The information integrity standard exists because credentialing records can be edited after the fact. A health plan policy implementing it, approved in October 2025, lists 5 kinds of inappropriate updates. They range from falsified credentialing dates to verification credited to someone who never performed it. The policy audits 5% of files or 50 files, whichever is less, with at least 10 initial and 10 recredentialing files. A follow-up audit comes within 3 to 6 months. Those numbers match the audit NCQA proposed when it introduced the standard.
Documents stand in for sources. In January 2023, federal investigators announced charges against 25 people in a scheme that distributed more than 7,600 fraudulent nursing diplomas and transcripts from Florida nursing schools, according to the HHS Office of Inspector General. Buyers could use them to sit for the national licensing exam. A license confirms a board’s decision, not the evidence behind it. Verification is only as good as the source it reaches.
Credentialed is not enrolled. A plan can credential a clinician the state has not enrolled in Medicaid. Federal law has required states to enroll all Medicaid managed care network providers since January 1, 2018. In a March 2020 report, OIG found that 21 states had not enrolled all of their managed care network providers, and that the federal share of managed care spending in those states was $85 billion in 2018. CMS agreed with OIG’s recommendations to keep unenrolled providers out of managed care networks.
Where Redlake stands
Redlake builds software health plans use in utilization review, not a credentialing system. But the 2 functions share a design problem. Both make consequential decisions from evidence that ages, and both are audited after the fact by sampling files. We hold our own work to 3 rules, and 2 of them carry straight over. A clinician makes every denial, and every decision can be reconstructed. Credentialing deserves the same discipline, and the 2026 standards are closer to it than the folder model suggests.
Make the verified fact the unit of work. Each verified credential should be its own record, carrying its source and its verification date. From those 2 facts, a system can compute when the credential expires under every clock that applies. A credentialing decision then becomes a check that every required fact is present and fresh, and a plan can see a file approaching its limit weeks before it expires. Shared verification follows naturally, as we argued in Verify a clinician’s credentials once, not once per plan.
Monitor as a feed. Monthly checks of every license in every state of practice are a data pipeline, not a task for an analyst with a list of websites, the case we made in Credentialing should be a feed.
Keep adverse decisions with people. Automation can confirm that a clean file is clean. A denial of participation or a termination affects a clinician’s livelihood and patients’ access to care. Those decisions belong with the credentialing committee, as NCQA’s peer review structure already requires, and each should carry the specific facts and criteria behind it.
Make every record reconstructable. The integrity standard asks plans to find inappropriate updates by sampling. A record that keeps an append-only history of every change and the person who made it turns that audit into a report rather than an investigation. We made the same argument for access to patient data in our piece on tamper-evident access logs.
Accreditation could follow. A surveyor who can query when each fact was verified and who changed it could review all of a plan’s files, not 8 of them.
What to watch in 2026
The multistate deadline. NCQA gives organizations 90 calendar days from the March 30 release to implement multistate monitoring. Plans that monitor only service-area states will need to know every state where each practitioner holds a license.
July 1. West Virginia’s 60-day clock and standard electronic form for Medicaid plans take effect. The 2026 NCQA standards govern surveys that start on or after this date.
State deadlines. California’s 90-day requirement follows a 1-year transition, with the CAQH form in 2028. Watch how regulators define a completed application, and whether other states copy Arizona’s deadline or California’s provisional approval.
Delegation agreements. Agreements renewed this year will still be in force for surveys after July 1, 2027, when they must address information integrity. Plans can add those terms now, along with delivery deadlines that fit inside the 120-day limit.
Federal directory data. CMS has been testing approaches to a national provider directory, with proof-of-concept contracts awarded in fall 2025, according to Medlearn. Medicare Advantage directory verification every 90 days begins in plan year 2028.
About this analysis
Basis. NCQA’s requirements are described from its published updates and proposals for its Health Plan Accreditation standards, along with its 8/30 file review procedure. Federal requirements come from the regulations as published by the Legal Information Institute, and state requirements from the laws and bill records cited. The failure analysis draws on 2 HHS OIG publications and a health plan’s published integrity policy. NCQA’s complete standards are licensed documents and were not reviewed in full.
Data notes.
- The state comparison covers 3 states with recent laws, not every state’s credentialing requirements.
- NCQA’s count of states requiring its accreditation for Medicaid plans comes from a page last updated in 2020.
- The integrity audit figures come from a health plan’s 2025 policy and NCQA’s proposal for the standard. Confirm current requirements in NCQA’s licensed standards.
Sources
- NCQA, Policy updates to the 2026 HPA standards and guidelines, March 30, 2026
- NCQA, 2025 Health Plan policy updates, November 18, 2024
- NCQA, HPA 2025 proposed standards updates, public comment November 2023 to January 2024
- NCQA, Credentialing Accreditation and CVO Certification proposed standards updates, public comment November 2023 to January 2024
- NCQA, 8/30 file review procedure and Making the most of accreditation
- Legal Information Institute, Medicare Advantage rules at 42 CFR § 422.204 and 42 CFR § 422.156
- Legal Information Institute, Medicaid managed care rules at 42 CFR § 438.214 and 42 CFR § 438.602
- Legal Information Institute, 42 CFR § 424.515 on Medicare enrollment and 45 CFR § 156.275 on exchange plan accreditation
- Arizona Legislature, Laws 2025, chapter 97 (SB 1291), approved May 2, 2025
- California AB 1041 bill record and the author’s signing announcement, October 11, 2025
- West Virginia Legislature, HB 4335, enrolled, 2026 regular session
- HHS Office of Inspector General, Twenty-three states reported allowing unenrolled providers to serve Medicaid beneficiaries, OEI-05-19-00060, March 30, 2020
- HHS Office of Inspector General, Operation Nightingale, January 25, 2023
- Network Health, Credentialing and recredentialing integrity policy, approved October 2, 2025
- Defacto Health, REAL Health Providers Act passed, February 23, 2026
Frequently asked questions
What are NCQA’s credentialing standards?
NCQA’s Health Plan Accreditation program has 9 credentialing standards, numbered CR 1 through CR 9. They start with credentialing policies and the committee and end with information integrity and delegation.
How old can a verification be under NCQA’s 2026 standards?
For most credentials, no more than 120 calendar days at the time of the credentialing decision, down from 180 before July 2025. Work history can be up to 180 days old, down from 365.
What changed in NCQA credentialing for 2026?
A policy change released March 30, 2026 requires monitoring of sanctions and license limitations in every state where a practitioner practices. NCQA also accepted licensure compacts when the home-state license is verified with the primary source and tightened how delegation audits cover the year.
Which states set deadlines for completing credentialing?
Arizona and West Virginia both set 60-day deadlines from a complete application, Arizona for health insurers from April 1, 2026 and West Virginia for Medicaid managed care plans from July 1, 2026. California requires a decision within 90 days, with provisional approval if a plan misses it.