A credentialing audit is not a document count. The reviewer opens the file to see when each item was verified, by whom, and whether it is still current on the date of the decision. A license verified fourteen months ago fails that test even though the paper is sitting right there. What follows is the document set, the date behind each item, and the explanation a reviewer expects when a gap turns up.
What this covers
- Every credential in the file needs a verification source and a verification date.
- NCQA-accredited plans may use data verified up to 180 calendar days before the decision, for files processed on or after July 1, 2025.
- CAQH ProView asks for re-attestation every 120 days, and a payer cannot pull the profile until that attestation is current.
- ABA files carry a second layer: RBT and BCBA certification dates, state licensure, and supervision records.
- Medicare revalidates enrollment every five years, and the practice has 60 calendar days to answer the notice.
The reviewer is not asking whether the credential exists. They are asking how recently someone confirmed it with the organization that issued it.Primary source verification is a date, not a document
What a credentialing audit actually checks
A credentialing file holds two things: the credential, and the evidence that someone confirmed it with the organization that issued it. Audits read the second part. A copied license or a CV is not verification. The payer or its credentials verification organization confirms the license with the state board, the certification with the certifying board registry, and the DEA registration with the DEA. What lands in the file is that confirmation and the date it happened.
State regulation mirrors that structure. Virginia’s managed care credentialing rule, 12VAC5-408-170, requires documentation of the current license and licensure history, hospital privileges and a valid DEA certificate where applicable, information from the National Practitioner Data Bank, board certification status, work history covering at least five years, and current malpractice coverage with five years of claims history.
| Item in the file | Confirmed with | What the record has to show |
|---|---|---|
| State license | State licensing board | License number, status, expiration, and the date the board was checked |
| Board certification | Certifying board registry | Current status and expiration, plus the registry lookup date |
| DEA registration | DEA, where the practitioner prescribes | Registration number, schedules, and expiration date |
| Malpractice coverage | Carrier certificate | Policy period, limits, and the date the certificate was pulled |
| Work history | Prior employers or a credentials verification organization | Employers and dates covering at least five years |
| Exclusion status | OIG LEIE and SAM.gov | Search date and the names searched, kept as proof |
Every row needs the document, the source that confirmed it, and the date of that confirmation. A file with the first and not the other two fails a review even when nothing in it is false.
Enrollment reviews reach past the practitioner. Medicare assigns a screening level by provider type, and the level decides how deep the review goes: a moderate designation brings an on-site visit, and a high designation adds fingerprint-based background checks for owners with a 5 percent or greater interest, under 42 CFR 424.518. Medicaid runs the same three-tier structure at 42 CFR 455.450.
Verification dates age out
Accredited plans work under a verification time limit. NCQA’s November 2024 update set the limit at 180 calendar days for files a plan or its delegate processes on or after July 1, 2025, down from the previous 365-day limit. A license verified well before the decision can expire as evidence before the committee ever meets.
CAQH ProView runs on a separate clock. A practitioner re-attests the profile every 120 days, or every 180 days in Illinois, and a payer cannot pull the data until that attestation is current. Skipping a window does not delete the profile. It stops the payer from starting.
This is the mechanism behind the delay every practice manager has seen. A file that sits for months over one missing item cannot resume where it stopped, because the verifications pulled early have aged out and have to be pulled again. A six-week delay over one item turns into a four-month enrollment.
A revalidation notice gives the practice 60 calendar days to submit a complete application under 42 CFR 424.515(a)(2). Without complete and accurate information within 90 calendar days, CMS may deactivate billing privileges under 42 CFR 424.540(a)(3), and services furnished during a deactivation cannot be paid.
What an ABA or behavioral health file adds
Behavioral health files carry a layer that medical files do not. A payer credentials the licensed practitioner. It also has to be able to see that every technician delivering direct treatment is certified and supervised.
Humana’s credentialing policy states that non-licensed applied behavior analysis providers fall outside the scope of practitioner credentialing. The BCBA or licensed behavior analyst holds the credential. The technician layer runs through state licensure, BACB certification, and supervision records the practice has to produce on request.
- Nevada Medicaid requires both BACB certification and RBT licensure under NRS 641D.300 from the Nevada Applied Behavior Analysis Board before a technician enrolls.
- Louisiana Medicaid requires a licensed behavior analyst to carry liability coverage of $1,000,000 per occurrence and $3,000,000 aggregate, and to submit a list of registered line technicians to the managed care organization quarterly.
- South Carolina’s autism provider manual requires copies of degrees and licenses, a SLED criminal record check updated annually, and child abuse registry checks completed before employment and annually after that.
When a technician changes supervisors, more than the schedule changes. Nevada Medicaid requires notice within five working days of a supervisor, clinical supervisor, or employer change, and its manual ties a failure to report to termination of the contract.
One roster feeds all of it. The technician who renders 97153 is the same person whose certification date, license number, background check, and supervision log have to be current in the state file, the payer file, and the practice’s own records.
The technician timeline, from hire to recertification
| Step | Requirement |
|---|---|
| Background and abuse registry checks | Completed no more than 180 days before the certification application is paid |
| 40-hour training | Completed in no less than 5 days and no more than 180 days, delivered by trainers who are active BCBAs or BCaBAs |
| Initial competency assessment | Completed after the training and within 90 days before applying |
| Monthly supervision | At least 5 percent of the hours spent providing behavior analytic services in a calendar month, with two face-to-face contacts and at least one individual meeting |
| Recertification | A two-year cycle with 12 professional development units, beginning with the 2026 recertification cycle |
Supervision is the item that shows up in an audit and nowhere else. State programs ask for the technician roster on a schedule, and a payer reviewing a sample of ABA claims checks the supervision log against the dates of service. South Carolina’s manual states that failure to comply with Medicaid policy requirements can lead to sanctions up to termination of enrollment.
Certification dates move on their own. A recertification that lapses mid-episode leaves the practice holding billed hours delivered by a technician whose certification had already ended, and the payer finds out months later when it pulls the file.
Gap explanations a reviewer will accept
A gap is not automatically a problem. An unexplained gap is. A reviewer wants the same three things on every late item: what happened, the date it happened, and what the practice did about it.
Cite the credential and the verification due date, for example a license renewal that posted 11 days after the file was submitted.
A board processing delay, a name change at the licensing board, a practitioner who moved states. Keep it factual and dated.
The board’s confirmation email or the renewal receipt. A statement without a dated record reads as an excuse.
The authorized official or the practitioner signs it. An unsigned explanation carries no weight.
Record what changed in the process so the same gap does not appear at the next recredentialing.
Exclusion screening follows the same rule. The OIG’s 2013 special advisory bulletin recommends checking the LEIE before hiring or contracting and periodically after that, and asks providers to keep documentation of each search, such as a printed screen shot. It also notes that providers are not required by statute to run the check. What is mandatory sits on the state side: 42 CFR 455.436 requires state Medicaid agencies to check the LEIE and the excluded parties list at least monthly.
Credentialing gaps also surface during record requests, which run on their own rule. 42 CFR 424.516(f) requires a practice to maintain the documentation behind orders, certifications, referrals, and payment requests for seven years from the date of service and to provide access when CMS or a contractor asks. The CMS fact sheet on that rule notes that failing to produce even one requested record can count as an instance of non-compliance, and each instance can weigh on the length of a re-enrollment bar under 42 CFR 424.535(c). A file that is current on credentials and silent on documentation still has a problem.
Medicare requires physicians, nonphysician practitioners, and their organizations to report a change of ownership, an adverse legal action, or a practice location change within 30 days, and every other enrollment change within 90 days, under 42 CFR 424.516(d). An unreported move is a gap the practice created.
Keeping the file current without a scramble
An audit-ready file is a calendar, not a project. Each credential has a date attached, so each date can sit on a schedule with a name next to it.
- One owner: a named person holds the credentialing calendar rather than a shared inbox.
- One folder per practitioner, with a naming rule that includes the verification date.
- A monthly exclusion screen against the LEIE and SAM.gov, with the results saved.
- A quarterly CAQH check for every practitioner, plus a supervision review for every technician.
- An annual look at licenses, DEA registrations, and malpractice certificates before any of them lapse.
- A 36-month recredentialing date for each payer, with the five-year Medicare revalidation date beside it.
Recredentialing is the long cycle. NCQA requires it every three years, and the verification work repeats rather than carrying forward from the initial file. For Medicare, 42 CFR 424.515 sets a five-year revalidation cycle, and CMS reserves the right to run an off-cycle revalidation at any point. Those notices go to the special payment and correspondence address on file, so an address nobody updates is its own kind of gap.
Credentialing also overlaps with documentation. Credentialing and payer enrollment keeps the practitioner record current, while comprehensive chart auditing catches the coding and documentation problems that turn into a records request. A file that is current on paper and thin in the chart still gets pulled.
Credentialing audit questions
The file and the evidence behind it: a signed application, primary source verification of the license, board certification, DEA registration, malpractice coverage and claims history, work history covering at least five years, and the results of exclusion screening. Every item needs a verification source and a date. Reviewers read the dates first, because a credential verified a year ago is not current evidence.
Recredentialing runs on a three-year cycle under NCQA standards, and the verification work repeats rather than carrying forward. Between those cycles, individual items move on shorter clocks: CAQH re-attestation every 120 days, licenses and malpractice certificates reviewed at least annually, and exclusion screening monthly. Medicare enrollment sits on a five-year revalidation cycle with off-cycle reviews on top.
That depends on state law and on the payer. Some payers place non-licensed ABA providers outside the scope of practitioner credentialing, so the BCBA or licensed behavior analyst holds the credential. Several state Medicaid programs enroll technicians directly. Nevada Medicaid requires BACB certification and RBT licensure under NRS 641D.300, plus a signed supervision acknowledgement naming the supervisor and that supervisor’s NPI.
NCQA’s credentialing standards set the verification time limit at 180 calendar days for files a plan or its delegate processes on or after July 1, 2025, down from 365 days. Many plan policies apply a tighter window of their own. The practical effect is that verifications cannot be banked. When a file stalls over one missing item, the verifications pulled before the stall age out and have to be repeated.
It depends on where the file sits. During credentialing, an expired item usually means a request for a current document and a fresh verification, which resets the dates on the rest of the file. After enrollment, a lapsed credential raises a payment question for every date of service it covers. A written explanation with dated proof belongs in the file before a reviewer asks for one.
Monthly is the practical standard. The OIG updates the LEIE monthly and recommends screening before hiring or contracting and periodically after that, which minimizes overpayment and civil monetary penalty exposure. Providers are not required by statute to run the check, while 42 CFR 455.436 requires state Medicaid agencies to check the LEIE and the excluded parties list at least monthly. Keep the search results.
The bottom line
A credentialing file is judged by its dates rather than its thickness. Every credential needs a source, a verification date, and someone who owns the next refresh. Build the calendar once, and the next audit becomes a file review instead of a fire drill.
When was each credential in your file last verified?
We build and maintain credentialing files for behavioral health practices: primary source verification, CAQH tracking, Medicaid and Medicare enrollment, technician certification and supervision records, and the recredentialing calendar that keeps each payer relationship active. Send us your roster and we will tell you which items are stale before a payer does. Our medical billing services team handles the enrollment follow-up.
Request a free credentialing file reviewThis article describes requirements published in federal regulations, state Medicaid manuals, and payer policies as of September 2026, and it is general information rather than legal advice. Confirm the current standard with your payer or state agency before you rely on it.
