The credentialing maintenance calendar — annual, semi-annual, and monthly touchpoints every practice needs

Most practices treat credentialing as an event. Provider joins the group, applications go out, approvals come in, done. That framing is why practices get blindsided six months later when a payer suspends billing privileges because a DEA registration expired and nobody updated the file.

Credentialing is not an event. It’s a calendar. Here is what that calendar looks like.

Why maintenance fails

The failure mode is always the same: no one owned the renewal. The state medical board sent a license-expiration notice to an address the provider hasn’t used in three years. The DEA sent a renewal notice to the provider’s personal email. The payer sent a re-credentialing packet to a fax number the practice disconnected. And because no single person was tracking all of it, none of it landed where it needed to land in time.

Billing disruption is the outcome. The payer has no obligation to warn you before it happens. Some will. Most will send a termination letter and let you figure out the rest.

The monthly touchpoints

Monthly credentialing maintenance is primarily CAQH management.

CAQH ProView attestations run on a 120-day cycle per provider. Every month, you have some slice of your roster approaching that deadline. Someone has to pull the attestation-status report, identify who’s due within 30 days, and execute the attestation before the profile flips to non-attested. On a roster of more than five providers, this is a recurring task, not an annual one.

Document upload checks run monthly as well. Malpractice certificates of insurance are the most common casualty — they expire annually, and payers pull the attached document, not just the credential. If the CAQH upload is stale even when the underlying policy is current, payers treat the credential as lapsed.

Payer enrollment status checks also belong here. Some payers update provider records in batches and don’t notify you when something changes. A monthly status sweep catches address mismatches, NPI discrepancies, and enrollment anomalies before they affect payment.

The semi-annual touchpoints

Every six months, two things need active attention:

Malpractice policy review. Tail coverage, aggregate limits, per-occurrence limits — these don’t change often, but when they do, payer contracts frequently require disclosure within 30 to 60 days. Semi-annual review catches policy changes in time to comply.

Hospital privilege status. Many commercial payers co-index credentialing with hospital privileges. If a provider’s privileges at an affiliated hospital have changed — scope reduction, lapse, voluntary surrender — you need to know before the payer finds out first. A semi-annual privilege audit against the hospital’s current credentialing records keeps you ahead of it.

The annual touchpoints

Annual renewals are the backbone of the maintenance calendar. They are also the most frequently missed because they’re on a 12-month cycle that doesn’t feel urgent until it suddenly is.

State medical licenses. Every state has its own renewal cycle, fee schedule, and CME requirement. A single provider licensed in multiple states has multiple independent renewal deadlines. Track each state separately, with 90-day, 60-day, and 30-day alerts. License expiration is a hard stop — no active license, no billing.

DEA registrations renew every three years and require 45 to 60 days for processing. The three-year gap fools practices into thinking DEA management is low-frequency work. It isn’t. Miss the renewal window by two months and the provider’s billing for Schedule II–V medications is interrupted while DEA processes the late renewal. Flag the expiration 90 days out, minimum.

Controlled substance registrations by state (CSR, DCSA, and state-equivalent registrations) each have their own cycles. Some are annual, some biennial. They often get forgotten because they live in the shadow of the DEA registration — but state-level prescribing authority is a separate credential and a separate renewal.

NPI record review. The National Plan and Provider Enumeration System doesn’t send expiration notices because NPI numbers don’t expire. But the taxonomy codes, practice addresses, and group enrollment records in NPPES do drift. Annual NPI record reviews catch stale data before payers use it to route claims incorrectly.

Payer contract review. Fee schedules are not permanent. Some payers update rates annually; some do it on a contract-cycle basis. Annual contract review — comparing actual contracted rates against the current schedule — catches silent rate reductions and creates a trigger for renegotiation.

The two-to-three year cycle

Payer re-credentialing. Most commercial payers re-credential on a 24- to 36-month cycle. The packet requirements look like a first-time application — work history, references, attestations, malpractice history, board certifications. The lead time from packet receipt to approval is typically 90 to 120 days, which means you can’t wait until the re-credentialing notice arrives to start gathering documents.

Board certifications. ABMS member boards have varying recertification cycles. MOC requirements, examination schedules, and attestation windows all vary by specialty. Some boards move these deadlines with little notice. Annual monitoring of board-certification status against specialty-specific MOC requirements is the only way to stay current.

Putting it on a single calendar

A credentialing maintenance calendar is not complicated. What makes it hard is that it covers multiple providers, multiple credential types, multiple payers, and multiple regulatory bodies — and every deadline is independent of every other deadline.

The practices that manage this well do one thing differently from the ones that get surprised: they own a unified expiration registry, with every credential’s next deadline in a single view and alerts set at 90, 60, and 30 days. That registry gets reviewed on a recurring monthly cadence. Nothing slips because nothing is waiting to be noticed — the calendar tells you what’s due.

What to do this week

1. Build the inventory. Pull every active provider’s credentials: medical license by state, DEA, CSR, malpractice COI, board certifications. Write down the next expiration date for each.
2. Sort by days to expiration. Anything under 90 days is your current work queue.
3. Set alerts at 90 / 60 / 30 days. Use whatever system you have — calendar, task manager, credentialing software. The tool matters less than the discipline.
4. Check CAQH. Pull the attestation report. Find everyone under 30 days. Execute attestations.

If running this calendar on top of everything else a practice has to manage isn’t viable, that’s the core of what we do. Talk to us about taking the maintenance calendar off your plate.

— Medical Credentialing Services