Provider credentialing requires nine categories of documents: identity, licensure, DEA registration, education and training certificates, board certification, malpractice coverage, complete work history, practice and billing details, and an attested CAQH profile. Assemble all nine before submitting anything — an incomplete file is the single most common reason credentialing takes 180 days instead of 90.
Most credentialing delays don’t come from hard problems. They come from a missing malpractice face sheet, an unsigned attestation, or a six-month gap in a CV that nobody explained. The fix is boring and it works: assemble a complete file before you submit anything.
Work through this credentialing checklist in order. Each section has to be genuinely complete before the next one pays off — and the last section, CAQH, is where most of the first four get verified anyway.
What documents are required for credentialing?
Every payer publishes its own list, but underneath they are asking for the same file. The table below is the master version: what to collect, who issues it, how long it realistically takes to obtain if you don’t already have it, and how often it expires — because the item that expires mid-review is the one that costs you a resubmission.
| Document | Who issues it | Lead time if you don’t have it | Expires |
|---|---|---|---|
| Government photo ID | State DMV / US State Dept | Days–weeks | 4–8 years |
| NPI (Type 1, individual) | NPPES (CMS) | Same day–2 days | Never |
| NPI (Type 2, group) | NPPES (CMS) | Same day–2 days | Never |
| State professional license | State licensing board | 8–14 weeks | 1–3 years, varies by state |
| DEA registration | US DEA | 4–6 weeks | 3 years |
| State controlled-substance registration | State board (where required) | 2–8 weeks | 1–3 years |
| Board certification | Specialty board (ABMS, AOA, AANP, ANCC) | Exam cycle — months | Continuous certification or ~10 years |
| Diploma / training certificates | School, residency, fellowship | 2–6 weeks to re-issue | Never |
| ECFMG certificate | ECFMG | Weeks | Never |
| Malpractice face sheet | Your carrier | Days | Annual policy term |
| Current CV | You | Hours | Update at every change |
| Work history & references | You | Days–weeks to chase | Ongoing |
| W-9 / voided check | Your practice / bank | Same day | On any TIN or bank change |
| CAQH ProView profile | CAQH | 1–2 weeks to build properly | Re-attest every 120 days |
Two rows on that table cause most of the damage. State licensure is the longest lead time on the list, and nothing downstream can start without it. CAQH re-attestation is the shortest cycle on the list, and it is the one nobody diarizes.
1. Identity & licensure documents
The foundation. Payers verify every one of these against the primary source, so they must be current — not “renewing soon.”
- Government-issued photo ID (driver’s license or passport)
- Individual NPI (Type 1) — and Type 2 if you’re credentialing a practice entity
- Current state medical/professional license(s) for every state you practice in
- DEA registration (and any state controlled-substance registration)
- Board certification certificate(s)
- Social Security number / date of birth on file for verification
A note on multistate work: you need a license in the state where the patient is located at the time of the visit, not where you are sitting. Telehealth does not change that, and neither does an out-of-state employer. If you are treating across state lines, every one of those states needs its own line on this checklist — see multistate telehealth licensing.
2. Education & training
- Medical/professional school diploma
- Residency and fellowship completion certificates
- ECFMG certificate (for internationally trained providers)
- Current CV with month-and-year dates and no unexplained gaps
That last item stalls more files than any other. Any gap longer than about 30 days triggers a payer query — account for every one directly on the CV before you submit. Parental leave, a research year, studying for boards, a relocation, a period of unemployment: all of these are completely acceptable answers. What is not acceptable is silence, because silence forces a human reviewer to stop and write to you.
Write gaps into the CV itself rather than in a separate letter. Reviewers work from the CV; anything in an attachment is something they have to go looking for.
3. Malpractice & work history
- Current malpractice insurance face sheet (showing coverage limits and dates)
- Malpractice claims history, if any (with explanations)
- Complete work history with employer names, addresses, and contact info
- Hospital affiliations and privileges, current and past
- Peer references (names and current contact details)
Most commercial payers expect coverage limits of at least $1M per occurrence and $3M aggregate for physicians, with lower limits commonly accepted for behavioral health clinicians. Check the limits your target payers require before renewing a policy — it is far cheaper to adjust at renewal than to re-file an application because the coverage didn’t meet the panel’s floor.
Peer references need to be reachable people who will actually respond. A reference who ignores three emails is functionally a missing document, and the application waits either way. Warn your references before you list them.
4. Practice & billing information
- Practice legal name, tax ID (TIN), and Type 2 NPI
- Practice address(es), phone, and service locations
- Voided check or W-9 for payer remittance
- List of the specific payers you want to join
If you are launching a new practice, settle the entity, EIN, Type 2 NPI and ownership structure before filing anything. A group application whose structure changes afterward does not get amended — it re-queues, and you lose the position you waited two months for.
5. Your CAQH profile
For nearly all commercial payers, CAQH ProView is where they pull your credentials from — so a complete, attested profile satisfies most of the list above in one place.
- CAQH ProView profile created (or an existing one cleaned up)
- Every section completed — blanks are a top rejection reason
- All documents uploaded and current (license, malpractice, DEA, W-9)
- Work-history gaps explained inside the profile
- Profile attested — and diarized to re-attest every 120 days
- Payer authorizations set so plans can actually access your data
The 120-day re-attestation is the item everyone forgets until a claim stalls with no obvious cause. Put it on a calendar the day you attest. The failure mode is genuinely silent: your profile does not disappear, payers simply find stale data and stop, usually without telling you which document triggered it.
6. Payer applications & enrollment
- Confirm which payers require credentialing vs. straight enrollment (they differ — see Credentialing vs. Enrollment vs. Contracting)
- Submit each commercial payer application with CAQH linked
- Enroll with Medicare via PECOS and your state Medicaid program as needed
- Record each application’s submission date and reference number
- Track status weekly until an effective date is issued per payer
- Confirm the retro-billing policy for each payer before scheduling patients
In several states, Medicaid is two steps rather than one: you enroll with the state Medicaid program first, and only then can each managed-care plan enroll you into its network. Texas works exactly this way through TMHP’s PEMS portal — filing both at once saves nothing, because the plan contract queue does not open until the state enrollment closes. See credentialing services in Texas for how that sequence plays out market by market.
Why a generic checklist template isn’t enough
A credentialing checklist template gets you the file. It does not get you the panel, because the last mile is payer-specific in ways no template can capture.
Every plan publishes its own application, its own supplemental forms, and its own idea of what counts as complete. Some pull everything from CAQH; some ignore CAQH and want their own portal filled in by hand. Some require a separate contracting packet after credentialing approves, which is the step that surprises practices who thought approval meant they could bill. Malpractice limits differ. Taxonomy requirements differ. Whether a nurse practitioner is paneled independently differs.
Use this checklist to build the file once — that part genuinely is universal. Then treat each payer as its own small project with its own requirements list, submission date and reference number. The practices that stay at the fast end of the 90–180 day range are not the ones with a better template. They are the ones tracking fifteen open applications individually instead of treating “credentialing” as one thing that either finished or didn’t.
What changes by provider type
The core file above is the same for everyone. Four things move depending on who you are.
Physicians (MD / DO)
The longest file, and the only one where hospital privileging usually runs in parallel. Expect board certification, ECFMG where applicable, DEA plus state controlled-substance registration, and the deepest work-history scrutiny — payers verify the full chronology back to training. If you are also seeking privileges, start that application first even though it finishes last: medical staff committees meet on a fixed calendar, and missing a packet deadline by two days costs a full cycle. See hospital privileging.
Nurse practitioners & physician assistants
Three additions that physicians don’t have:
- Collaborative practice or supervising physician agreement, where your state requires one
- Prescriptive authority documentation, including any state-specific registration
- National certification (AANP, ANCC, NCCPA) rather than an ABMS board certificate
The complication is that scope of practice is state law, so the same NP file is complete in one state and incomplete in another. Payers also vary on whether an NP or PA is credentialed as an independent panel provider or billed incident-to under a supervising physician — that decision changes both the application and the claims that follow, so settle it before filing rather than after a denial.
Behavioral health clinicians (LPC, LCSW, psychologist)
- Independent license, not a provisional or associate license
- Supervision hours documentation, if recently independently licensed
- Malpractice coverage at the limits your target panels require
- Taxonomy code that matches how you intend to bill
Two differences matter most. First, most behavioral health clinicians have no DEA registration, and that is fine — leave it off rather than leaving it blank with no explanation. Second, provisionally licensed clinicians generally cannot be paneled at all; the license level, not the experience, is what payers underwrite. Some plans also run their own credentialing portals instead of pulling from CAQH, so budget for per-payer data entry that a physician file wouldn’t need. See behavioral health credentialing.
Groups and facilities
A group is credentialed as an entity in addition to each provider individually. That means a Type 2 NPI, the group’s own W-9, ownership disclosure, and a roster process for adding providers later. The roster is the part worth setting up properly on day one — every provider you add afterward runs through it, and a group with no roster process re-invents the whole file each time. See group enrollment & contracting.
When to start each item
Working backward from the date you want to see patients:
| Timing | What happens |
|---|---|
| 6+ months out | State licensure, if you don’t hold it yet. Longest lead time on the list. |
| 120 days out | Build or clean up CAQH, gather every document in the table above, chase references. |
| 90 days out | File commercial applications and Medicare/Medicaid enrollment. The clock you don’t control starts here. |
| Weekly, throughout | Follow up on every open application. Untouched files are where timelines die. |
| At approval | Confirm the effective date in writing per payer, then check retro-billing rules before scheduling. |
What the payer actually does with your file
Knowing what happens on the other side explains why several items on this checklist matter more than they look.
Primary source verification. Payers do not take your copy of a document as proof. They verify against the issuing source — the state board for your license, the DEA registry, the school for your diploma, the specialty board for certification. This is why a document that is technically current but shows differently at the source, like a license with a pending renewal, stops a file. Your paperwork and the source have to agree.
NPDB query. Most payers query the National Practitioner Data Bank for malpractice payments, adverse licensure actions and clinical privilege restrictions. If something is in there, disclose it up front with your own explanation attached. A disclosed and explained event is a normal part of many credentialing files. The same event discovered by a reviewer after you left it off the application is a different conversation entirely.
Sanctions and exclusion screening. Expect checks against the OIG List of Excluded Individuals and Entities, the SAM.gov exclusion list, and your state Medicaid exclusion list. These are re-run periodically after you’re approved, not just once at application.
Attestation review. The signed attestation is what makes everything else legally binding. Unsigned or undated attestations are one of the most common “incomplete application” bounces, and they are entirely avoidable.
After you’re approved, the checklist doesn’t stop
Approval is a state you maintain, not a finish line.
- Effective date confirmed in writing for every payer
- Retro-billing policy checked per payer before scheduling patients against it
- CAQH re-attestation diarized at 120 days, permanently
- License, DEA, malpractice and certification renewal dates on one calendar
- Re-credentialing cycle diarized — most payers re-verify every 2–3 years
- Medicare revalidation tracked separately, generally every 5 years
- Any address, TIN, ownership or roster change reported to every payer, promptly
A lapse here is worse than a delay at the start, because you are billing when it happens. Termination from a panel for a missed re-credentialing deadline means claims deny, the patients you have already seen become uncollectable, and re-application starts from the beginning. See re-credentialing & maintenance.
The mistakes that stall a file
Even a complete checklist gets undone by a few recurring errors:
- Expired documents. A license or malpractice sheet that lapses mid-review sends you back to the queue.
- Unexplained work-history gaps. The most common cause of a mid-review pause.
- A stale CAQH attestation. Silent, and it stops everything downstream.
- Slow responses to payer requests. Two weeks in an inbox is two weeks added to your start date.
- Filing before the entity is settled. A changed EIN or ownership structure re-queues the application rather than amending it.
- Blank fields instead of “not applicable.” A reviewer cannot tell the difference between “no DEA because I’m an LCSW” and “forgot to fill this in.”
- Assuming retro billing. Treating patients before confirming a payer pays back to the visit date is how practices work for free.
Getting all of this right the first time is exactly why credentialing has a realistic 90–180 day timeline — and why a clean file is the only real way to stay at the fast end of it.
Print this checklist
Everything above is the complete checklist — no email gate, no download form. Print this page straight from your browser and work it document by document; the tables and checkboxes are built to survive the print stylesheet.
Prefer to hand the whole thing off? A 20-minute consult gets a specialist building your file with you, so nothing on it is the reason your start date slips.