Verify a clinician’s credentials once, not once per plan. When a physician joins a health plan’s network, the plan checks the same facts every other plan checks. It confirms that the license is valid and the board certification current, then looks at the malpractice history and the federal exclusion lists. The primary sources are the same for every plan, and so are the answers.
Yet each plan verifies them separately and on its own schedule. According to a May 2024 CAQH issue brief, a physician practice holds, on average, 20 health plan contracts. A single license can be verified 20 times by 20 organizations, and then again by each of them every 3 years.
The same facts, checked again and again
Credentialing standards are largely uniform. NCQA’s credentialing requirements, which most commercial and Medicare Advantage plans follow, call for primary source verification of a defined set of credentials, completed within a set window before the credentialing decision. As we described in January, NCQA shortened that window from 180 days to 120 days in July 2025, and since then it has also required monthly monitoring of sanctions and exclusions.
| Credential | Typical primary source |
|---|---|
| License to practice | State licensing board |
| DEA or controlled substance registration | DEA or state agency |
| Education and training | Training program, or a designated equivalent source |
| Board certification | Certifying board |
| Malpractice history | National Practitioner Data Bank |
| Sanctions and exclusions | Federal exclusion lists and state boards |
The table summarizes common credentialing verification elements. Specific requirements vary by standard and program.
None of these checks depends on which plan is asking. A state board reports the same license status to every requester. The data bank returns the same report. The only things that vary are the timing of the check and the paperwork around it.
The industry has already centralized part of the work. Many clinicians enter their information once in a shared application repository and authorize plans to view it, which spares them from filling out 20 versions of the same form. But the repository holds what the clinician reported. Each plan, or its credentials verification organization, still goes back to the primary sources to confirm it.
A license is verified the same way no matter which plan asks. It should only have to be verified once.
What verifying once would require
Verifying once does not mean trusting a clinician’s word, or giving up a plan’s responsibility for its network. It means separating 2 things that are usually bundled together. The verification of facts is identical across plans, while the decision to admit a clinician belongs to each plan.
The verification side would need 4 things.
- A trusted verifier. Credentials verification organizations already perform primary source verification for plans that delegate it, and NCQA certifies them. A shared verifier serving many plans is an extension of a model that exists, not a new one.
- A standard record. Each verification should be recorded the same way, naming the credential and the source along with what the source said and when. A plan relying on the record should be able to see all of that, not just a checkmark.
- Continuous freshness. A plan’s decision needs verifications within the required window. A shared record updated as sources report changes, as we argued in February, is always within the window.
- Clear accountability. Plans remain responsible for the clinicians in their networks. Delegation agreements and audits of the verifier would carry over, as they do with credentials verification organizations today.
The gains would be substantial. Practices would answer fewer requests, and plans would stop paying for work that tells them nothing new. New clinicians would join networks faster, which matters to patients in areas where access is thin. A single well-run process is also easier to audit than 20 variations.
What stays with each plan
Some parts of credentialing should remain with each plan, because they reflect the plan’s own judgment.
The credentialing decision itself belongs to the plan’s committee. So does the judgment about network needs, such as whether a plan needs more clinicians in a specialty or region, and the contract terms that follow. A plan may also apply criteria beyond the minimum, such as additional review of clinicians with certain malpractice histories, and it should be free to do so with the shared verifications as its starting point.
Medicare enrollment is also separate. A clinician’s enrollment with Medicare through CMS’s own systems is a federal process with its own revalidation cycle, and Medicare Advantage plans generally require that a clinician not be excluded or opted out. A shared verification record could reference that status, but it would not replace the enrollment.
What we build for
We build tools health plans use in utilization review, and credentials appear in that work in 2 ways. They matter for the clinicians whose requests a plan reviews and for the clinicians who make the decisions. In both cases, what matters is whether a credential was valid at the moment it mattered, and whether the plan can show where that knowledge came from.
We think credentials should be treated as shared, timestamped facts with a clear source, verified once and reused wherever they are needed, rather than as documents that each organization collects and files on its own. Every decision we help record should be reconstructable, and that includes knowing which verification of a reviewer’s license the plan relied on and when it was made.
Verifying once is not a technology problem. The sources and the verifiers already exist. What is missing is the agreement that a verification performed well by a trusted party is good enough for everyone who needs it.