If you have ever used the words credentialing, enrollment, and privileging like they mean the same thing, you are not alone. But they are not the same. Mixing them up causes real problems. A provider can be fully credentialed but not yet enrolled, which means they cannot get paid. A provider can be enrolled but not yet privileged, which means they cannot perform certain procedures at a hospital. You need all three. This guide breaks down each one, shows how they fit together, and tells you exactly what you need to do to get them done.
What Is Credentialing?
Credentialing is the process of verifying that a healthcare provider is qualified to practice. It is a thorough investigation of the provider’s background. Think of it as a background check on steroids.
What Gets Verified
The credentialing process looks at every part of a provider’s professional history. You verify:
- Education – Medical school, residency, fellowship. You contact each institution directly. You do not take the provider’s word for it.
- Training – Internships, clinical rotations, any supervised practice periods.
- Work history – Every job the provider has held. You check for gaps in employment. You confirm start and end dates.
- Licensure – Current state medical license. Active status. No restrictions. You check with the state licensing board directly.
- Board certifications – Which boards certified the provider. When the certification expires. Whether it is in good standing.
- DEA registration – Active DEA number. Prescriptive authority. Controlled substance registration.
- Malpractice history – Any past or pending malpractice claims. Settlements. Judgments.
- Sanctions and exclusions – Any disciplinary actions from state medical boards. Any exclusions from Medicare or Medicaid. You check the OIG List of Excluded Individuals and Entities (LEIE) and the state Medicaid exclusion list.
- Professional references – Letters from colleagues who have worked with the provider.
Primary Source Verification
Every piece of information must be verified at the primary source. You do not call the provider’s office to confirm their medical school graduation. You call the medical school registrar directly. You do not ask the provider for a copy of their license. You check with the state licensing board.
The National Committee for Quality Assurance (NCQA) and The Joint Commission both require primary source verification for credentialing. No exceptions.
Who Needs Credentialing
Credentialing applies to all clinical staff who provide independent patient care. That includes:
- Physicians (MD and DO)
- Nurse practitioners (NP)
- Physician assistants (PA)
- Certified nurse midwives (CNM)
- Clinical nurse specialists (CNS)
- Certified registered nurse anesthetists (CRNA)
- Physical therapists (PT)
- Occupational therapists (OT)
- Speech-language pathologists (SLP)
- Psychologists
- Licensed clinical social workers (LCSW)
- Dentists
If the provider bills independently for their services, they need to be credentialed.
How Long Credentialing Takes
Credentialing is not fast. The typical timeline is 90 to 120 days from application submission to completion. That assumes you have all your documents ready and you respond quickly to any requests for more information.
Delays happen when:
- Previous employers do not respond to verification requests
- Medical schools take weeks to send transcripts
- The provider has gaps in employment history that need explanation
- State licensing boards have backlogs
- Malpractice claims require additional documentation
Recredentialing
Credentialing is not a one-time event. Recredentialing happens every two to three years, depending on state requirements and accreditation body standards.
The recredentialing process reviews:
- Any changes in licensure or board certification
- Any new malpractice claims
- Any disciplinary actions
- Updated work history
- Current competence and performance data
If a provider fails recredentialing, they lose their ability to practice at that organization.
What Is Privileging?
Privileging asks a different question. Credentialing asks “is this provider qualified?” Privileging asks “what specific procedures can this provider perform at this facility?”
Scope of Practice
Two surgeons can hold identical credentials and still receive different privileges at the same hospital. One might be authorized to perform laparoscopic cholecystectomy. The other might not. Privileges are based on demonstrated competency, not just paper qualifications.
Privileging determines:
- Which surgical procedures the provider can perform
- Which diagnostic tests the provider can order
- Which treatments the provider can administer
- Which patient populations the provider can treat (adults only, pediatrics, both)
- Which settings the provider can work in (inpatient, outpatient, emergency, ICU)
What Goes into a Privileging Decision
The privileging decision is made by the organization’s medical staff leadership and governing body. They review several things:
- Verified credentials – The provider must be fully credentialed first. You cannot privilege someone whose credentials are not verified.
- Case logs – The provider must show evidence of performing specific procedures. A surgeon who wants privileges for a new technique needs to document how many times they have done it, what the outcomes were, and whether they received formal training.
- Peer recommendations – Other providers in the same specialty vouch for the applicant’s competence.
- Facility resources – Does the hospital have the right equipment? Does it have the right support staff? You cannot grant privileges for a procedure if the facility cannot support it.
- Ongoing performance monitoring – Between privileging cycles, providers are evaluated through OPPE (Ongoing Professional Practice Evaluation) and FPPE (Focused Professional Practice Evaluation). OPPE looks at routine performance. FPPE looks at specific concerns or new privileges.
Facility-Specific Nature of Privileges
Here is where providers get into trouble. Privileges are not transferable. A provider credentialed at one hospital cannot automatically perform the same procedures at another hospital. They must apply for and be separately evaluated for privileges at each individual facility.
A cardiac surgeon with privileges at Hospital A cannot walk into Hospital B and start operating. Hospital B needs to run its own credentialing and privileging process. That process may take weeks or months.
Federal Requirements for Privileging
Federal regulations under 42 CFR 482.22 require hospitals that participate in Medicare and Medicaid to have a formal privileging process for all medical staff members. This is a Condition of Participation. If a hospital does not follow these rules, it can lose Medicare funding.
The regulation requires that the hospital’s governing body ensures each practitioner is granted privileges consistent with their training, experience, and current competence.
Temporary Privileges
Hospitals can grant temporary privileges in emergency situations. For example, a specialist from another hospital might need to cover call for a weekend. The hospital can grant temporary privileges for a limited time, usually 30 to 90 days, while the full credentialing and privileging process runs.
Temporary privileges are not automatic. The provider must still meet basic qualifications, and the hospital must have a process for verifying those qualifications quickly.
What Is Enrollment?
Enrollment is the process of joining insurance provider networks. It establishes a provider’s relationship with payers so they can bill for services and receive reimbursement.
The Purpose of Enrollment
Credentialing and privileging govern clinical authorization within a healthcare organization. Enrollment governs a provider’s ability to get paid. You can be the most qualified surgeon in the country. You can have full privileges at a top hospital. If you are not enrolled with a patient’s insurance plan, you are not getting paid for that patient’s care.
Enrollment tells payers:
- Who the provider is (name, NPI, tax ID)
- Where the provider practices (address, facility name)
- What type of provider they are (specialty, taxonomy code)
- That the provider meets the payer’s qualification standards
Medicare Enrollment
Medicare enrollment requires submitting the CMS-855 form. There are several versions of this form depending on what type of provider you are and what type of organization you work for:
- CMS-855A – For institutional providers like hospitals and skilled nursing facilities
- CMS-855B – For clinics, group practices, and certain suppliers
- CMS-855I – For individual physicians and non-physician practitioners
- CMS-855O – For ordering and referring providers who do not bill Medicare directly
- CMS-855R – For reassigning benefits from an individual to an organization
The CMS-855I for an individual physician is over 30 pages long. You need to provide detailed information about your education, training, work history, malpractice coverage, and any disciplinary actions. You also need to submit supporting documents like copies of your license, DEA certificate, and board certification.
Once you submit the application, Medicare screens you against the OIG List of Excluded Individuals and Entities. If your name appears on that list, your application is denied. You cannot bill Medicare for any services, and you cannot work at any facility that receives Medicare funding.
Medicaid Enrollment
Medicaid enrollment is separate from Medicare. Each state runs its own Medicaid program. Each state has its own application process. Some states use a single application for both Medicare and Medicaid. Most do not.
If you practice in multiple states, you need to enroll in each state’s Medicaid program separately. There is no national Medicaid provider number.
Commercial Payer Enrollment
Commercial payers like UnitedHealthcare, Anthem, Cigna, and Aetna have their own enrollment processes. Some use a standard application called the CAQH ProView. Others have proprietary applications.
The CAQH ProView is a centralized database. You complete your profile once, and multiple payers can access it. That saves you from filling out the same information for every payer. But you still need to contract with each payer individually. CAQH ProView handles the data collection, not the contracting.
Credentialing vs. Enrollment vs. Privileging: Key Differences
| Credentialing | Privileging | Enrollment | |
| Purpose | Verify qualifications | Authorize specific procedures | Enable billing and payment |
| Core question | Is this provider qualified? | What can this provider do here? | Can this provider get paid? |
| Who grants approval | Credentialing committee | Medical staff leadership & governing body | Insurance payers (Medicare, Medicaid, commercial) |
| Basis for decision | Education, licensure, training, history | Competency, case volume, peer review, facility resources | Contract agreements, network participation |
| Facility-specific? | No (qualifications follow provider) | Yes (specific to each facility) | Payer-specific (each plan requires separate enrollment) |
| Renewal cycle | Every 2-3 years | Every 2 years | Varies by payer |
Credentials Verification Organizations (CVOs)
Many payers use Credentials Verification Organizations (CVOs) to handle enrollment. A CVO is a third-party company that verifies provider credentials on behalf of payers. You submit your documents to the CVO once, and the CVO shares the verified information with multiple payers.
The CVO must follow NCQA standards for credentialing. They perform primary source verification just like a hospital would. Payers trust the CVO’s verification, so they do not duplicate the work.
How Long Enrollment Takes
Enrollment timelines vary by payer:
- Medicare – 60 to 90 days for initial enrollment. Faster for updates and changes.
- Medicaid – 30 to 90 days depending on the state. Some states are faster. Some are much slower.
- Commercial payers – 60 to 120 days. Some payers process quickly. Others take months.
Most enrollment delays are due to insufficient or untrained staff and a lack of automation. Missing documents, incomplete applications, and slow responses to payer questions are the biggest drivers of delay.
How Credentialing, Privileging, and Enrollment Work Together
These three processes are sequential and interdependent. They are not parallel. They are not interchangeable.
- Step 1: Credentialing – This comes first. You verify the provider’s qualifications. You collect primary source verification of education, training, licensure, and history. Until this is done, nothing else moves forward.
- Step 2: Privileging – Once credentials are verified, you determine what specific procedures the provider can perform at your facility. Privileging decisions are built on the verified information from credentialing. You cannot privilege a provider whose credentials are not verified.
- Step 3: Enrollment – This can happen in parallel with privileging, but it is the last piece to fall into place. You need the provider’s credentials verified. You need their privileges defined. Then you submit enrollment applications to payers. Enrollment does not require privileging information directly, but you want the provider fully approved on the clinical side before you invest time in enrollment.
Revenue Impact of Credentialing and Enrollment Delays (Why This Matters)
Most articles stop at definitions. That is not enough. The real issue is money.
A delay in enrollment is not just an administrative problem. It directly affects revenue.
Let’s break it down with a simple scenario:
A hospitalist bills around $450 per encounter
Sees 15 patients per day
Works 20 days per month
That equals:
$450 × 15 × 20 = $135,000 per month
Now imagine a 90 day enrollment delay. That is over $400,000 in missed billable revenue.
Retroactive Billing Limits
Many providers assume they can bill later. That is only partially true.
Most payers allow retroactive billing for only 30 to 90 days from the effective enrollment date.
If your enrollment takes 120 days, the first 30 to 60 days of services may never be reimbursed.
That creates permanent revenue loss.
Hidden Costs Most Practices Ignore
Enrollment delays also trigger indirect costs:
You may need locum tenens providers to cover patient volume
You lose continuity of care
Staff time increases due to billing confusion
Patients may go elsewhere
This is why credentialing and enrollment timelines should be treated as revenue operations, not admin tasks.
Telehealth and Multi State Enrollment Complexity
Telehealth changed everything, but it also created new compliance risks.
A provider might be licensed in one state and treating patients in another. That sounds simple, but it creates a problem.
If you are licensed in State A but treating a patient located in State B, you must:
Be licensed in State B
Be enrolled with State B Medicaid or relevant payer
Meet that state’s billing requirements
If not, you risk denied claims or compliance violations.
Interstate Medical Licensure Compact (IMLC)
The Interstate Medical Licensure Compact helps physicians get licensed faster across multiple states.
But it does not remove the need for enrollment in each state.
Licensure is step one. Enrollment is still required separately.
PSYPACT for Psychologists
The PSYPACT allows psychologists to practice telepsychology across participating states.
Again, licensing becomes easier. Billing and enrollment do not.
COVID Era Changes
During the COVID-19 pandemic, CMS allowed temporary waivers for telehealth across state lines.
Some flexibility stayed. Much of it did not.
You still need to verify state specific enrollment requirements today.
The Role of the National Practitioner Data Bank (NPDB)
Credentialing without NPDB checks is incomplete.
The National Practitioner Data Bank is a federal database that tracks:
Malpractice payments
Adverse privileging actions
Licensure sanctions
Hospitals must query NPDB before granting privileges. This is required under federal law.
If a provider has a negative NPDB record:
- It can delay credentialing
- It can impact privileging decisions
- It may require additional review
Hospitals must also report adverse actions back to NPDB. Failure to report is a violation.
Providers can run their own NPDB self query before applying.
This helps:
- Identify errors
- Prepare explanations
- Avoid surprises during credentialing
Group Practice vs Hospital Credentialing (Critical Difference)
Most providers misunderstand this.
Credentialing does not work the same way in a hospital and a group practice.
In Hospitals
You have:
Formal credentialing
Formal privileging
Medical staff committees
Regulatory oversight
In Group Practices
There is:
No formal privileging process
Credentialing happens mainly through payer enrollment
Focus is on billing eligibility, not procedural authorization
This difference affects how quickly a provider can start working.
Workarounds During Enrollment Delays
When enrollment is delayed, practices often look for temporary solutions.
Incident To Billing
Under Medicare rules, a physician can bill for services performed by an NP or PA.
But strict conditions apply:
A physician must supervise
Patient must be established
Plan of care must already exist
If you misuse this, you risk compliance violations.
Locum Tenens Billing
Locum tenens allows temporary providers to bill under another provider using a Q modifier.
This is useful when:
A provider is waiting for enrollment
A physician is on leave
But this is temporary. It does not replace proper enrollment.
Delegated Credentialing
Large organizations often use delegated credentialing.
This means:
A hospital or large group performs credentialing
The payer accepts their verification
Instead of repeating the process.
- Faster onboarding
- Reduced duplication
- Centralized control
Delegation must meet National Committee for Quality Assurance standards.
If the organization fails an audit:
The payer can revoke delegation
All providers may need re credentialing
That creates massive disruption.
What Happens When You Skip a Step
-
- Credentialed but not privileged – The provider has verified qualifications but cannot practice at your facility.
- Credentialed and privileged but not enrolled – The provider can practice but cannot get paid for insured patients. You either bill the patient directly (if allowed) or write off the charges.
- Enrolled but not credentialed – This should not happen. No responsible payer enrolls a provider without credentialing them first. If it does happen, the provider is at risk of billing fraud.
- Who Is Responsible for Each Process
- Credentialing – Typically handled by the medical staff office at a hospital or the credentialing department at a large practice. Smaller practices often outsource credentialing to a CVO.
- Privileging – Handled by the medical staff office and the governing body of the specific facility where the provider will practice.
- Enrollment – Handled by the billing department or a dedicated enrollment specialist. Large practices often have a team just for payer enrollment.
Common Problems and How to Avoid Them
Problem 1: Gaps in Employment History
Any gap longer than 30 days needs an explanation. If the provider took time off for family leave, travel, or illness, document it. Unexplained gaps trigger additional scrutiny and delay the process.
How to avoid – Have the provider prepare a complete timeline of their professional history before you start the application. Address every gap in writing.
Problem 2: Malpractice Claims
One malpractice claim is not necessarily a problem. Multiple claims, large settlements, or a pattern of similar issues will raise red flags.
How to avoid – Be upfront about claims. Provide the full story, not just the bare facts. Include information about any changes the provider made to their practice as a result of the claim.
Problem 3: Slow Responses from Primary Sources
Medical schools, residency programs, and prior employers do not always respond quickly to verification requests. Some take weeks. Some take months.
How to avoid – Start the verification process early. Follow up regularly. Keep records of every contact attempt. If a source does not respond after multiple attempts, document your efforts so you can show you tried.
Problem 4: Incomplete Enrollment Applications
Missing signatures, missing attachments, and incorrect information are the top reasons enrollment applications get rejected.
How to avoid – Use a checklist for every application. Have a second person review the application before submission. Keep templates for common information so you are not typing the same data repeatedly.
Problem 5: Expired Documents
Licenses expire. DEA registrations expire. Board certifications expire. If you submit an application with an expired document, it gets rejected.
How to avoid – Track expiration dates in a database. Set reminders 90 days before each expiration. Start the renewal process early.
Conclusion
Credentialing, privileging, and enrollment are three separate processes. Credentialing proves who the provider is. Privileging decides what the provider can do at a specific facility. Enrollment lets the provider get paid for doing it.
You need all three. You need them in the right order. And you need to manage them continuously, because credentials expire, privileges get reviewed, and payer contracts change.
The providers who get this right have a system. They track deadlines. They use checklists. They start early. They follow up relentlessly. The providers who get it wrong lose months of revenue while they wait for their applications to be processed.
Do not be the provider who gets it wrong.
FAQS
Can a provider start working before enrollment is complete?
Yes, a provider can start seeing patients, but billing becomes risky. If enrollment is not active, claims may get denied or fall outside the retroactive billing window. Many practices either hold claims or use limited workarounds, such as incident-to billing. Still, this creates cash flow delays and compliance concerns if not handled carefully.
What happens if a provider’s enrollment is denied?
A denial means the provider cannot bill that payer at all. The practice must correct the issue and resubmit, which can take another 30 to 90 days. In some cases, services already provided may not be reimbursed. That is why clean applications and follow-ups matter from day one.
How often do providers need recredentialing and revalidation?
Credentialing repeats every 2 to 3 years, depending on the organization or accrediting body. Enrollment revalidation with payers like Medicare happens every few years as well, often every 3 to 5 years. Missing deadlines can lead to deactivation, which stops payments immediately.
Can credentialing, enrollment, and privileging occur simultaneously?
Parts of the process can run in parallel, but not everything. Credentialing must start first since it verifies qualifications. Enrollment can begin once basic data is ready, even before privileging finishes. Smart practices overlap these steps to reduce onboarding time by several weeks.
What is the biggest cause of delays in these processes?
Incomplete applications cause most delays. Missing documents, incorrect NPIs, outdated licenses, or gaps in work history slow everything down. Slow responses from primary sources and a lack of follow-up also add weeks. A structured checklist and tracking system usually solves most of these issues.
Get Credentialing and Enrollment Right the First Time
Credentialing, privileging, and enrollment are not just processes. They are revenue drivers.
Delays cost money. Mistakes create compliance risks. Poor tracking leads to denied claims.
RCM Xpert Medical Billing Services helps you manage the entire lifecycle, from credentialing to enrollment to ongoing compliance. You get faster approvals, fewer errors, and predictable revenue.
If you want providers credentialed faster and paid on time, this is where you start.
Talk to a Medical Credentialing Expert At RCM Xpert
