Every payer verifies the same nine categories for every clinician: identity, licensure, education and training, board certification, DEA registration, malpractice coverage, work history, practice and billing details, and an attested profile. What changes by provider type is which body counts as the primary source for each item, and which of three well-known extras apply.
That is the whole subject. The nine categories are why a generic credentialing checklist is useful; the sources and the extras are why a generic checklist is not sufficient. This guide is the per-type layer.
Part 1: The rules the verification runs under
Before the type-by-type matrix, three mechanics decide how your file is handled, and none of them are obvious from the application form.
Verification means the source, not your copy
Primary source verification is the payer confirming a credential with the body that issued it. Your license is verified with the licensing board, not with the PDF you uploaded. Your training is verified with the program. Your certification is verified with the certifying board’s registry.
The consequence is counter-intuitive and worth stating plainly: assembling a perfect document packet does not directly speed up verification. What it does is remove the ambiguity about where to look — the correct legal name, the correct license number, the correct program, the correct dates. Ambiguity is what turns a two-day verification into a three-week one.
Verifications expire before your license does
NCQA sets a verification time limit measured from the date a credential was verified to the date of the credentialing decision. Under corrections to NCQA’s 2025 credentialing standards, that limit is 180 calendar days for files processed by the organization or its delegates on or after July 1, 2025 — files processed before that date were scored against the previous 365-day limit. NCQA’s credentialing certification standards (the ones CVOs are measured against) run a tighter 120 calendar days, including for work history.
What this means for you: a file that stalls does not simply resume. Verifications age out, and the ones that aged have to be pulled again. This is the mechanism behind the pattern every practice manager recognizes — a file that sat for four months over one missing item somehow takes another two months after the item arrives.
The sanction screen is broader than most people expect
NCQA’s 2025 standards name the acceptable sources for Medicare and Medicaid sanction and exclusion checks: for sanctions, the State Medicaid agency, the AMA Physician Masterfile, the FSMB, the NPDB or SAM.gov; for exclusions, the State Medicaid agency, the OIG’s List of Excluded Individuals and Entities, or the NPDB. Most payers run several, and they run them across all product lines.
Two practical notes. A name variant — a maiden name, a hyphenation, a middle initial that appears on one license and not another — can generate a false positive that you will be asked to disprove. And an exclusion is not something you clear during credentialing; it is something you resolve first, elsewhere.
Compact licenses change the source, not the requirement
NCQA accepts a licensure compact arrangement between states if the practitioner’s licensure was primary source verified in the practitioner’s home state, and reviews the compact agreement for evidence that the state accepts the home state’s license in lieu of its own. So a compact does not eliminate verification — it relocates it to your home state and adds a document that has to be present. Multi-state practices should assemble the license map before applications go out, not in response to a deficiency notice. That is the core of medical licensing and telehealth licensing as separate disciplines.
Part 2: The matrix — what changes by provider type
Below, the license source is the state board that issues it; the certification source is the registry that verifies it. The “watch this” column is the item most likely to be the reason a file of that type sits.
| Provider type | License verified with | Certification / exam verified with | DEA | Watch this |
|---|---|---|---|---|
| Physician (MD/DO) | State medical board | ABMS member board or AOA registry | Yes | Work-history gaps; ECFMG certification for international graduates |
| Radiologist | Every state where the patient is located, verified separately | Certifying board’s public record, incl. subspecialty | Setting-dependent | The license map — reading for a hospital in another state needs that state’s license |
| Nurse practitioner | State board of nursing — RN and APRN, verified separately | AANP, ANCC, PNCB, NCC or AACN, in the population focus | Yes, plus state controlled-substance registration | Population focus must match the panel; collaboration/delegation agreement where the state requires one |
| Physician assistant | State PA or medical board | National PA certification registry | Yes, where prescribing | The prescriptive authority and delegation agreement itself, signed and current |
| CRNA | State board of nursing — RN and APRN with CRNA recognition | National nurse anesthetist certifying body | Where controlled substances are prescribed | Facility privileging usually runs in parallel and on a different clock |
| Psychologist | State psychology board | Doctoral program, internship and postdoc hours; ABPP only where a specialty is claimed | Rarely | PSYPACT authority where held — the PSYPACT directory is itself a primary source |
| Therapist / counselor (LPC, LCSW, LMFT) | State behavioral health board | Supervised clinical hours from the board record | Usually none | Provisional vs. independent license — provisional generally cannot be paneled |
| Chiropractor | State chiropractic board | National Board of Chiropractic Examiners transcript | No | On-site imaging: some networks add a facility or equipment questionnaire |
| Podiatrist | State podiatry authority | Residency program; ABFAS or ABPM where certified | Yes | Hospital and ASC privileges where surgical cases are performed |
| Optometrist | State optometry board | National Board of Examiners in Optometry | Scope-dependent | Therapeutic and glaucoma certifications are separate records, not assumptions |
| Dentist | State dental board | Dental school registrar; specialty board where a specialty rate is claimed | Yes | Sedation or anesthesia permit where the practice provides it; dental plans often run their own network entirely |
| Physical / occupational therapist, SLP | State board for the discipline | National licensure examination record | No | Medicare treats them as their own enrollment category with a 30-day retro window |
| Behavior analyst (BCBA) | State license where the state licenses the profession | The certification board’s public registry | No | Whether the payer enrolls assistants and technicians at all, or only the licensed analyst |
Each row has a page with the state-level detail, the real timeline for that type, and the verification set spelled out item by item: nurse practitioners · physician assistants · CRNAs · psychologists · therapists and counselors · chiropractors · podiatrists · optometrists · dentists · radiologists
Part 3: The three deltas that actually stall files
Across thousands of files, most type-specific delay traces to one of three things.
1. Supervision, collaboration and delegation agreements
For NPs and PAs, several states require a written agreement with a physician covering supervision, delegation or prescriptive authority. Payers ask for the agreement itself — signed, dated, naming the right physician, and consistent with what the state board has on record.
The failure mode is rarely the absence of an agreement. It is an agreement that names a physician who has since left, or a scope that does not match the services being billed, or a version that was never counter-signed. Because the document lives with the practice rather than a board, nobody notices until a payer asks.
2. The missing DEA registration
Most therapists, counselors, social workers and chiropractors have no DEA registration and never will. Application forms and CAQH profiles frequently treat DEA as expected, and a blank field is indistinguishable from an incomplete one to an automated completeness check.
The fix is to state the absence rather than leave the field empty — an explicit “not applicable to this license type” closes the loop. It is a small thing that removes a recurring week.
3. Provisional and associate licenses
Provisionally licensed clinicians — LPC-Associates, LMSWs under supervision, postdoctoral psychology fellows — generally cannot be credentialed on commercial panels as independent providers. Payer policies vary in the details but converge on requiring an independent license.
This is a hiring and staffing question disguised as a paperwork question. A group practice that hires four associates and plans to bill for them has to know, before the offer letters, which payers will recognize them and under what supervision arrangement. Behavioral health groups feel this hardest, which is why behavioral health is planned around license status rather than headcount.
Part 4: CAQH — one profile, every payer, and a 120-day clock
Most commercial payers pull your credentials from CAQH rather than from your application. An incomplete or un-attested CAQH profile stalls a file exactly as hard as no profile.
Two things to know as of 2026:
- CAQH has rebranded. The parent organization now operates as DataSpring, powered by CAQH, and the provider-facing portal previously called CAQH ProView is now the CAQH Provider Data Portal. Your login, profile, documents and payer authorizations carry over; proview.caqh.org still resolves. Nothing about your obligations changed — only the name on the door.
- Re-attestation is required at least every 120 days. The cycle runs from your last attestation, and letting it lapse makes your data stale to every payer pulling from it at once.
Three items decide whether a CAQH profile helps or hurts: it must be complete, it must be attested, and each payer must be authorized to view it. A profile that is complete and attested but not authorized for the payer you just applied to is invisible. That maintenance is what CAQH setup and maintenance covers, and it is the cheapest recurring thing in the whole process to get right.
Part 5: The universal file, assembled once
Whatever your license type, the same nine categories are being assembled. In practical terms:
- Identity — government photo ID, Social Security number, NPI (Type 1 for you, Type 2 for the entity).
- Licensure — every active state license, plus compact documentation where it applies.
- Education and training — diploma, transcripts, residency or supervised-hours records, and ECFMG certification for international medical graduates.
- Board certification — where you hold it, and always where a specialty rate is being claimed.
- DEA registration — plus state controlled-substance registration where the state has one, or an explicit “not applicable.”
- Malpractice — the current face sheet with limits, and claims history.
- Work history — continuous, with a written explanation for any gap. This is the item most often missing and most often the reason for a second round.
- Practice and billing details — legal entity name, TIN, W-9, service locations, remit address.
- Attestation — signed, current, and consistent with everything above.
Our provider credentialing checklist is the long-form version of this list, built to print. The point of assembling it once is that the same file feeds Medicare enrollment, Medicaid enrollment, every commercial application and your CAQH profile — and inconsistency between those copies is its own category of delay.
Part 6: The clocks that keep running afterward
Credentialing is not a project with an end date. Four unrelated clocks start the day you finish:
- Recredentialing — payers rebuild the file on a cycle, commonly every 36 months, with fresh verifications.
- Medicare revalidation — every five years for providers and suppliers generally, and every three for DMEPOS suppliers.
- CAQH re-attestation — at least every 120 days.
- Directory accuracy — under the No Surprises Act, plans must verify provider directory information at least every 90 days, and must have a procedure to remove providers whose information they cannot verify. Your demographic data is now something a payer will actively test rather than passively store.
Missing any of these is more expensive than the original credentialing, because the outcome is not “delayed” — it is “terminated, reapply.” Keeping the four calendars in one place is the whole job of recredentialing and maintenance.
Find your type, then work from its actual list
The nine categories are universal. The sources, the extras and the failure modes are not — and a checklist written for a physician will quietly mislead a counselor, an optometrist or a behavior analyst.
If you want the exact list for your license type, your states and your payer mix, a 20-minute consult produces it, with a written scope before anything is committed.
Sources: NCQA, Corrections, Clarifications and Policy Changes to the 2025 CR-PN Standards and Guidelines (Nov. 17, 2025); CAQH / DataSpring (caqh.org); 42 CFR 424.515 and 424.57(g); 42 U.S.C. 300gg-115 (provider directory verification). Provider-type verification sources are drawn from the state boards and certifying registries named on each specialty page. Verified 2026-08-12.