Healthcare Credentialing Checklist — Every Document
A complete provider credentialing file is the foundation of healthcare compliance. Every document that is missing, expired, or improperly verified creates risk: Joint Commission survey findings, CMS deficiencies, payer clawbacks, and malpractice exposure. This checklist covers every document you need per provider, when each document must be verified, and the verification source for each.
Complete Provider Credentialing Document Checklist
The following table lists every document required in a complete provider credentialing file, organized by verification source and renewal timeline. Use this as your master checklist for initial credentialing and ongoing monitoring.
| Document | Verification Source | Renewal | Notes |
|---|---|---|---|
| State Medical License(s) | State Medical Board / FSMB | 1-3 years by state | One per state of practice. PSV required. |
| DEA Registration(s) | DEA / NTIS | Every 3 years | Per state. Required for prescribing providers. |
| Board Certification(s) | Specialty Board (ABMS/AOA) | 6-10 years | PSV required. Some boards have MOC requirements. |
| Medical School Diploma | Medical School / NCCRS | One-time | PSV required at initial credentialing. |
| Residency Completion Letter | Training Program | One-time | PSV required. Include fellowship if applicable. |
| NPI Verification | NPPES | Verify annually | Confirm NPI is active and information is current. |
| Malpractice Insurance Certificate | Insurance Carrier | Annually | Verify coverage amounts meet facility requirements. |
| NPDB Query Results | NPDB | At least every 2 years | Required by Joint Commission at reappointment. |
| OIG Exclusion Check | OIG LEIE | Monthly (best practice) | Federal requirement for Medicare/Medicaid participation. |
| SAM Exclusion Check | SAM.gov | Monthly (best practice) | Federal debarment and exclusion check. |
| Work History (5-10 years) | Previous Employers | One-time | Verify gaps exceeding 6 months. PSV for current/recent. |
| Professional References (3+) | Peers/Supervisors | One-time | From providers who have directly observed clinical work. |
| Privilege Delineation Form | Internal | At reappointment (2 years) | Specifies approved clinical activities per provider. |
| Signed Attestation Statement | Provider | At reappointment | Covers health status, malpractice history, criminal history. |
| CME Documentation | CME Providers / Specialty Board | Varies by state/specialty | Required for license renewal and MOC. |
| Government-Issued Photo ID | Provider | At expiration | Required for identity verification. |
| CMS Enrollment Verification | PECOS | At re-enrollment | Verify active Medicare enrollment status. |
| State Controlled Substance License | State Board of Pharmacy | 1-3 years by state | Required in some states in addition to DEA. |
Would You Pass a CMS Survey Today?
Free 3-minute survey-readiness audit walks through every Condition of Participation. CFR-cited gaps, no signup, no email. Built for HHA, hospice, and SNF compliance leads.
Initial Credentialing vs. Recredentialing: What Changes
Initial credentialing and recredentialing (reappointment) have different requirements. Understanding the distinction prevents you from over-collecting or under-collecting documents at each stage.
Initial Credentialing
- All 18+ documents in the checklist above
- Full primary source verification of education and training
- Complete work history with gap explanations
- Three or more professional references
- Full application with signed attestations
- Timeline: 60 to 120 days
Recredentialing (Every 2 Years)
- Current state license verification (PSV)
- Current DEA registration verification
- Current board certification status
- Updated malpractice insurance certificate
- New NPDB query
- Updated attestation statement
- OPPE/FPPE review results
- Privilege reappointment recommendation
Ongoing Monitoring Requirements Between Credentialing Cycles
The Joint Commission and CMS do not allow you to wait until recredentialing to catch issues. Ongoing Professional Practice Evaluation (OPPE) and continuous monitoring are required between credentialing cycles.
Monthly Monitoring Checklist
Quarterly Monitoring Checklist
How Audit-Ready Are You?
Take our 30-second compliance check to see where your system stands. No email required.
Common Credentialing File Deficiencies
These are the most frequently cited credentialing deficiencies in Joint Commission surveys and payer audits:
Automate Your Credentialing Checklist with FileFlo
FileFlo tracks every document in this checklist for every provider in your organization. AI document intelligence extracts expiration dates, names, and credential types automatically when you upload documents. The platform sends 90/60/30-day alerts before any credential expires and generates instant audit-ready reports for Joint Commission surveys and payer audits.
- $299/month flat rate, unlimited providers, unlimited documents
- AI extracts expiration dates and credential types automatically
- One-click audit reports organized by provider, credential type, or status
Frequently Asked Questions
A complete initial credentialing file typically contains 15 to 25 documents per provider, depending on specialty and the number of states where the provider is licensed. This includes state medical licenses (one per state), DEA registrations (one per state), board certifications, medical school diploma, residency/fellowship completion letters, malpractice insurance certificate, work history verification, references, NPDB query results, NPI verification, privilege delineation forms, and signed attestation statements. For multi-state providers, the count can exceed 30 documents. FileFlo tracks all of these in one centralized platform at $299/month with unlimited providers.
Reverification timelines vary by document type. State medical licenses: at renewal (every 1 to 3 years depending on state). DEA registrations: every 3 years. Board certifications: at recertification (every 6 to 10 years depending on specialty board). Malpractice insurance: annually at policy renewal. NPDB queries: at least every 2 years (Joint Commission requires it at reappointment). OIG/SAM exclusion checks: monthly is best practice. CMS enrollment verification: at re-enrollment. FileFlo's automated alerts track every expiration date and send notifications at 90, 60, and 30 days before renewal is due.
Primary source verification (PSV) means confirming a credential directly with the issuing authority rather than relying on a copy provided by the provider. Required PSV includes: medical school graduation (verified through the school or NCCRS), residency/fellowship completion (verified through the training program), state medical license status (verified through the state medical board or Federation of State Medical Boards), board certification (verified through the specialty board), DEA registration (verified through DEA or NTIS), and NPDB query results (direct query). Copies from providers are not sufficient for accreditation or CMS compliance.
Credentialing is the process of verifying a provider's qualifications: education, training, licensure, certifications, and work history. Privileging is the separate process of granting a provider permission to perform specific clinical activities (procedures, treatments, consultations) at your facility based on their demonstrated competence. Both are required by the Joint Commission and CMS. Credentialing establishes that the provider is qualified; privileging determines what they are authorized to do at your specific facility.
The typical initial credentialing timeline is 60 to 120 days. The biggest delays come from primary source verification (PSV), which depends on response times from medical schools, training programs, and state boards. Some state boards take 4 to 6 weeks to respond to verification requests. Incomplete applications from providers add additional delays. Organizations using automated credential verification and tracking platforms like FileFlo can reduce this timeline by 30 to 50% by automating follow-ups and tracking verification status in real time.
Incomplete credentialing files create multiple risk areas: Joint Commission survey findings (one of the most common RFI categories), CMS Conditions of Participation deficiencies, payer contract violations that can lead to claim denials or clawbacks, malpractice insurance coverage gaps, and state regulatory sanctions. The financial exposure per incomplete file ranges from $5,000 (payer clawbacks) to $100,000+ (if a patient harm event occurs involving a provider with incomplete credentials). Prevention through systematic tracking costs a fraction of remediation.
Related Articles
Continue learning about compliance and operational excellence
How to Track DEA Registration Expirations Across a Multi-Provider Practice
Practical guide to managing DEA registration renewals across multiple providers and states with automated tracking and compliance monitoring.
What Is Provider Credentialing and Why Does It Take So Long?
Comprehensive explanation of the provider credentialing process, typical timelines, common bottlenecks, and strategies to accelerate verification.
State Medical License Renewal Requirements: 2026 Guide by Specialty
State-by-state medical license renewal requirements for 2026, organized by specialty with CME hours, renewal fees, and timeline guidance.