NCQA credentialing standards decide how a payer verifies a clinician, how often it repeats the check, and what evidence it expects when the work is delegated. A practice does not have to be NCQA-accredited to feel them. They reach the file the moment a payer delegates credentialing, or the moment the practice signs with a health plan whose network standards follow NCQA. This article lays out the primary source verification elements, the three-year recredentialing cycle, and the records a delegation audit will ask for.
What this covers
- Primary source verification confirms each credential with the issuing authority: the state board for a license, the specialty board for certification, the NPDB or the carrier for malpractice history.
- The 2025 standards set verification windows measured from the credentialing decision, from 180 days for a license down to 90 days for several elements on the certification track.
- Recredentialing runs at least every three years, and compliance is measured month to month, so most teams work a 34- or 35-month internal cycle.
- Between cycles, sanctions, license expirations, complaints and quality issues are monitored, and sanction reports are reviewed within 30 calendar days of release.
- When a payer delegates credentialing, its annual audit samples the delegate’s files, checks the delegation agreement, and reviews semiannual reports.
A verification is a snapshot. It proves the credential was valid on the day it was checked, so the window and the recredentialing cycle carry as much weight as the check itself.The date of every check is what the payer audits.
Credentialing is not a single event. It is a verification step, a committee decision, a monitoring loop, and a renewal. NCQA writes the rules a payer applies to all four, and the payer passes them down through the contract. Read the standards once and the paperwork stops looking arbitrary, because every date in the file traces back to a rule.
How NCQA standards reach a medical practice
The National Committee for Quality Assurance is a private, nonprofit organization that accredits and certifies health care organizations. Its credentialing program sets the rules a health plan follows when it verifies a clinician’s qualifications and keeps that file current. NCQA offers two tracks. Credentialing Accreditation is for organizations that run the full process, including a credentialing committee. Credentialing Certification is for organizations that verify credentials and report the results to a client.
A small practice rarely holds either status. NCQA standards still reach the practice’s file in three situations. They govern NCQA-accredited organizations, organizations that seek a delegation agreement from an NCQA-accredited health plan, and organizations that perform credentialing for clients under NCQA rules. A behavioral health group that signs a delegation agreement with a payer lands in the second group, and the payer’s annual audit becomes the point of contact.
Delegation is what pulls a practice into the standards. The delegation agreement names the credentialing tasks the practice will perform, and NCQA holds the payer responsible for overseeing them.
Primary source verification, element by element
Primary source verification, usually shortened to PSV, confirms a credential with the organization that issued or maintains it. A copy of a license is not verification. A query to the state board is. NCQA accepts a primary source, a recognized source, or a contracted agent of the primary source, which is how electronic verification services qualify.
| Element | Verified with | Frequency |
|---|---|---|
| License to practice | State licensing board in every state where the clinician treats patients | Initial and recredentialing |
| DEA or CDS registration | DEA or state controlled substances agency, when prescribing is in scope | Initial and recredentialing |
| Education and training | The school or program that awarded the highest level of training | Initial only |
| Board certification | The specialty board, or an approved display agent such as the ABMS | Initial and recredentialing |
| Work history | A five-year review documented from the application or CV | Initial only |
| Malpractice history | The NPDB or the malpractice carrier, for the past five years | Initial and recredentialing |
| State licensing sanctions | The licensing board, the NPDB or the FSMB | Initial and recredentialing |
| Medicare and Medicaid sanctions | The OIG LEIE, the NPDB or the state Medicaid agency | Initial and recredentialing |
| Application and attestation | A signed and dated application the practitioner attests to | Initial and recredentialing |
Two rules cut the work. NCQA only requires verification of the highest level of education or training, so a board-certified physician does not need a separate check of medical school and residency. Work history is reviewed rather than verified with each employer, and it is only required at initial credentialing.
A work history review covers at least five years. A gap of six months or more needs an explanation, and a gap of a year or more needs that explanation in writing.
The verification windows under the 2025 standards
NCQA shortened its verification timeframes effective July 1, 2025. Each window is measured backward from the date of the credentialing decision, not from the day the application arrived. A file decided on July 1, 2025 has to show each verification dated inside its window.
| Element | Accreditation window | Certification window |
|---|---|---|
| License to practice | 180 days | 90 days |
| Board certification | 120 days | 90 days |
| Work history | 180 days | 120 days |
| Malpractice history | 120 days | 90 days |
| State licensing sanctions | 120 days | 90 days |
| Medicare and Medicaid sanctions | 120 days | 90 days |
| Application and attestation | 180 days | 120 days |
| Medicare and Medicaid exclusions | 120 days | 90 days |
The window is the reason credentialing calendars exist. A license verified in January can be stale by the time a slow payer reaches a June committee. A team that re-checks aging elements before the decision keeps the file inside its window. A team that does not usually finds the license verification is the element most likely to expire first.
The license window is the longest on the accreditation track, but the file is measured at the decision date. If the decision slips, the earliest verifications age out and have to be repeated before the committee can act.
The credentialing team works these windows against a live calendar for each payer, because one clinician often carries several files with different decision dates.
The three-year recredentialing cycle
NCQA requires recredentialing at least every three years, and the federal rule for Medicare Advantage sets the same floor. 42 CFR 422.204 requires a Medicare Advantage organization to recredential physicians and other health care professionals at least every three years.
The cycle is measured month to month, not by the calendar year. Most credentialing teams run an internal cycle of 34 or 35 months so the file clears before the third-year deadline. A file that reaches the committee on the last day of month 36 is late, and a late file is a finding.
Recredentialing repeats the work of initial credentialing with fresh dates. The application and attestation are collected again, the license, board certification, malpractice history and sanctions are verified again, and the practitioner signs a new attestation of correctness. Education and training drop off after the initial file unless the practitioner reports new training.
A practice can also use provisional credentialing once for an initial applicant. NCQA allows it when the file shows primary source verification of a current, valid license and five years of malpractice history, with a signed application and attestation. The provisional approval lasts 60 calendar days, and the practitioner cannot appear in a directory until full credentialing finishes.
Recredentialing does not restart the relationship. It refreshes the evidence and the dates, and the committee decision is a new decision that has to be documented.
Ongoing monitoring between cycles
A three-year cycle leaves a long gap, so NCQA requires monitoring in between. The organization tracks practitioner sanctions, license expirations, complaints and quality issues. A sanction report is reviewed within 30 calendar days of its release. When a source does not publish reports on a regular schedule, the organization queries it at least every six months.
Medicare and Medicaid sanctions are the element most practices watch. NCQA accepts the NPDB Continuous Query as a source for ongoing monitoring, and the OIG exclusion list is also acceptable. NCQA does not require a SAM.gov check, but CMS requires one for managed Medicaid, so a practice that holds both contracts runs both.
NCQA describes the monitoring as monthly for sanctions, license expirations, complaints and quality issues. A quarterly review does not match the standard.
Monitoring is where a delegation audit looks first, because it is the easiest place to find a gap. A file with a clean initial verification and no monitoring log for two years fails the same standard as a file with no verification at all.
What a delegation audit asks for
When a payer delegates credentialing to a practice or to a practice’s credentialing partner, the payer keeps responsibility for the work. NCQA evaluates delegation in two ways. It assesses the delegate’s performance, and it checks whether the payer oversees the delegate. The audit is the practice’s side of that second test.
The delegation agreement comes first. It has to be mutually agreed, signed and dated, name the activities delegated, set reporting at least semiannually, and keep the payer’s right to make the final credentialing decision. The payer evaluates the delegate’s capacity before signing, then reviews the delegate’s policies and files at least once a year.
The annual file review uses NCQA’s sampling method: five percent of the network or 50 files, whichever is smaller, with at least 10 initial credentialing files and 10 recredentialing files. Where the sample finds a problem, the payer issues a corrective action plan and the practice answers it. If the delegate is itself NCQA-accredited or NCQA-certified, the payer can skip the formal oversight, because NCQA has already reviewed the work.
The practice-side evidence is a fixed set of documents. A file audit does not ask for a narrative. It asks for the record.
- A signed and dated delegation agreement that lists the delegated activities and the reporting schedule.
- Written credentialing policies and procedures, including the criteria and the committee process.
- The credentialing committee roster and the minutes of its decisions.
- The current provider roster with effective dates.
- Credentialing files that show each verification with its date, its source, its outcome, and the initials of the verifier.
- Ongoing monitoring logs for sanctions, license expirations and complaints.
- Semiannual reports to the payer, with the payer’s review and any corrective actions.
One detail ties the file to the claim. When a practice bills adaptive behavior treatment under 97153, the payer can match the rendering provider to the credentialed roster and the effective date. A credential that lags the first claim date turns a clean claim into a denial.
Record the date, the source and the outcome on the day it happens, not when the file is assembled.
Before the committee decision, re-verify anything that has fallen outside its window.
Keep a monthly log of sanctions, license expirations and complaints, with the review date.
Review the delegation agreement each year and confirm the reporting schedule is being met.
NCQA credentialing questions
No. NCQA standards are required of NCQA-accredited organizations, organizations seeking a delegation agreement from an NCQA-accredited health plan, and organizations that credential for clients under NCQA rules. A practice that only submits applications to payers is not bound directly, but the payer’s own file review usually follows the same standards, so the same evidence answers the request.
Credentialing is the first review, run before a clinician joins a network. Recredentialing repeats that review on a cycle. NCQA requires it at least every three years, and the federal rule for Medicare Advantage sets the same three-year floor. The second review refreshes the dates, collects a new attestation, and gives the committee a new decision to document.
Each element has its own window, measured from the credentialing decision. Under the 2025 standards a license is good for 180 days, and board certification, malpractice history and sanctions are good for 120 days on the accreditation track. The certification track uses shorter windows, from 90 to 120 days. Anything older than its window must be verified again.
The payer reviews the delegate’s policies and files at least once a year. The file review uses NCQA’s method: five percent of the network or 50 files, whichever is smaller, with a minimum of 10 initial credentialing files and 10 recredentialing files. A finding triggers a corrective action plan that the practice has to answer.
Yes. A practice can contract with a credentials verification organization that performs primary source verification and reports the results. If that CVO holds NCQA Credentialing Certification, the payer is relieved of formal oversight for the elements the CVO is certified for, which reduces the audit burden. The practice still owns the committee decision.
NCQA describes monitoring as monthly for sanctions, license expirations, complaints and quality issues. When a sanction report is released, it is reviewed within 30 calendar days. If a source does not publish reports regularly, the organization queries it at least every six months. The NPDB Continuous Query is an accepted source for ongoing monitoring.
The bottom line
NCQA standards are a set of dates and sources, and a practice that treats them that way stays audit-ready. Verify each element at its source, keep every verification inside its window, and run the three-year cycle on an internal clock that finishes early. The file that proves all three is the file a payer will accept.
Running a delegation agreement or facing a credentialing audit?
The MedFactor credentialing team reviews delegation agreements, credentialing files and monitoring logs against the current NCQA windows, and rebuilds the pieces that will not survive an audit. See how we work with practices and we will show you what the payer will sample first.
Request a free credentialing file auditThis article summarizes NCQA credentialing standards and 42 CFR 422.204 as general information, not legal advice, so confirm the current standards and your payer contract terms before you rely on them.
