Credentialing Services vs In-House: How Practices Handle Payer Credentialing

Payer credentialing is the work that turns a licensed hire into a clinician a plan will pay: enrollment with Medicare, enrollment with your state’s Medicaid program, and panel applications with each commercial plan you accept.

It is per clinician and per payer — one counselor joining three plans is three files, not one — and none of it ends at the approval.

A credentialing file has to stay alive afterward: profiles re-attested (CAQH puts an un-attested profile in expired status the day after re-attestation was due), licenses and liability certificates re-verified, enrollment records updated when a clinician moves or your practice adds a location — Medicare requires reporting a change, addition or deletion of a practice location to your contractor within 30 days.

Deadlines run through all of it, and not all of them are yours.

Plans and credentials verification organizations working under NCQA’s credentialing programs verify against timeframes NCQA sets: under NCQA Credentialing Accreditation, a signed credentialing application attestation must be no older than 180 days when the credentialing decision is made, and a license verification no older than 180 days — 90 days for the license under NCQA’s Credentialing Certification.

Those are standards for accredited organizations, not a law binding your practice, but they explain why a plan can come back for a fresh attestation on a file you thought was finished.

Timeliness is also the chronic weak spot.

An MGMA Stat poll published November 4, 2025 — a trade-association poll, self-reported by the medical groups that answered and not behavioral-health-specific — found 65% of medical groups said credentialing and reappointment files were on time, while 32% reported some backlog.

Treat it as a description of the failure mode rather than a benchmark: whichever route you pick, files drift when nobody owns the calendar.

Part of the clock is set by law.

Arizona law requires a health insurer to conclude credentialing within 60 calendar days of receiving a complete application and to load the provider into its billing system within 30 days — one state’s statute, so check what your own states require.

What is actually published about the full ramp from NPI to panel decision, the credentialing timeline guide covers; this page stays on who does the work.

Running credentialing in-house means naming an owner: an office manager who absorbs it, a dedicated credentialing coordinator, or — in a small practice — you.

The routine work is less about legal knowledge than about accuracy, document control and a calendar, and the federal systems are set up so practice staff can carry it.

NPPES lets a provider give other people — your practice staff included — surrogate access to apply for or update their NPI record through the CMS Identity and Access System.

On a Medicare enrollment application, the practice can name office or credentialing staff as the contact person, and the Medicare Administrative Contractor will discuss the pending application with that contact.

On the CAQH side, a profile can list credentialing contacts by practice location, and the Practice Manager Module lets your office enter the data shared by all your providers once and export it to their profiles.

Two limits matter even in-house.

The contact person’s authority stops at the pending application — the contact person is only authorized to discuss issues concerning that application.

And the clinician keeps the two steps only they can take: signing the Medicare enrollment and attesting the CAQH profile.

If the function becomes a hire, one signal helps: NAMSS launched the Certified Provider Enrollment Specialist (CPES) credential, first exam in fall 2025, covering payer enrollment, Medicare enrollment, revalidation and reassignment, and CAQH practitioner, organization and practice manager accounts.

Because the credential is new, few specialists hold it yet — treat CPES as a strong plus and test everything else directly.

Our other employer guides on credentialing and staffing are collected in the behavioral health hiring hub.

A credentialing company — the term covers enrollment services, credentialing consultants and the credentialing arms of billing companies — takes over the preparation and follow-up: building application packets, chasing licenses and liability certificates, entering clinicians into the systems, tracking attestation and revalidation cycles, and pushing stalled files with payers.

What the vendor sells is process; your staff get their calendar back.

What no vendor can do is cross the two lines the systems draw.

Only the enrolling practitioner may sign the PECOS application or the paper CMS-855I — the practitioner cannot delegate that signature to anyone else, so a vendor can prepare an enrollment down to the last field and the clinician still signs it.

CAQH draws the same line at attestation: per CAQH’s own guide, the provider logs in, imports the practice’s exported data, completes the authorization section and attests.

A service that claims it will “handle attestation for you” is describing a step CAQH’s guide assigns to the provider.

Know what kind of company you are talking to, because “credentialing” covers two different businesses.

NCQA runs a Credentialing Certification program for credentials verification organizations — CVOs — which verify practitioners’ credentials through primary or recognized sources and report the information to their clients.

An enrollment service files your applications; a CVO performs verification work and reports it to clients.

Ask which hat a prospective vendor wears on your file.

Keep CAQH itself straight while you compare vendors: it is a data portal, not a payer, and it credentials no one.

The plans your clinician authorizes pull the profile and run their own credentialing, so a complete, attested profile is never network participation by itself.

Delegated credentialing — a plan formally allowing another organization to perform credentialing work on its behalf — exists too.

In a Colorado Division of Insurance survey (plan/filing year 2023), 14 of 18 carriers allowed delegated credentialing of behavioral health providers.

That is one state’s survey, not a national rate, but it tells you the arrangement is real; if your group grows into one plans rely on, ask each plan whether it delegates and what it demands of a delegated group.

The third route is folding credentialing into your billing company’s work.

The same two lines apply — your clinician signs and attests — and the data question gets sharper, because a billing vendor necessarily handles claims, which pulls patient information into scope.

That question gets its own section below.

Vendors differ in scope, and the differences only surface if you ask.

Put these questions in the first conversation, and get the answers in writing:

• Which tasks do you perform end to end, and which do you prepare for our clinicians to finish? The honest answer includes the Medicare signature and the CAQH attestation staying with the clinician.
• Are you an enrollment service, a credentials verification organization, or both? Ask which role the team working your file actually plays, and what any NCQA certification covers.
• Who holds the logins to NPPES, PECOS, CAQH and each payer portal — and in whose name are those accounts? You want accounts and profiles that survive the vendor relationship.
• Will your staff create, receive, maintain or transmit patient information as part of this work? Claims processing and billing put protected health information in scope, and so does any work that handles patient records, eligibility checks included (next section).
• How do you track recurring deadlines — attestation cycles, revalidations, license and certificate expirations — and what reporting do we get? The answer should include your own inbox, not only the vendor’s dashboard.
• What credentials do the specialists on our file hold? The NAMSS CPES credential is the one built for enrollment work; it is new, so expect experience and behavioral health references to carry more weight than acronyms.
• What are your turnaround promises based on? No payer publishes a credentialing timeline for behavioral health specialties, so a vendor’s number is a promise about the vendor’s process, not a payer commitment — and where a state sets a statutory clock, measure against that.
• How do we get our data, our documents and our account access back if we part ways? The exit question is the one practices forget.

Credentialing runs on clinician data — license numbers, NPIs, work histories, liability certificates.

It is sensitive, but credentialing data on its own may not be protected health information, and that distinction decides your paperwork.

Under HIPAA, a business associate is a person or company, other than your workforce, that creates, receives, maintains or transmits protected health information for your practice — the definition reaches functions like claims processing and billing.

A vendor that only builds and files credentialing applications might never touch PHI.

A vendor whose scope also includes billing or claims work — anything that handles patient records — does.

So ask the scope question before you sign, not after: will any part of the vendor’s work create, receive, maintain or transmit PHI?

If it will, federal HIPAA rules let a covered practice hand PHI to a business associate only after obtaining satisfactory assurance — in a written business associate agreement — that the vendor will safeguard it.

The agreement has to establish the permitted uses of PHI, require the vendor to use appropriate safeguards, and require it to report any use or disclosure the contract does not provide for.

Sign it before data moves.

If the scope is credentialing-only — no claims, no eligibility checks, no patient records — credentialing data alone may not be PHI, and the business associate rules turn on PHI.

That reading is an inference from the rule’s wording rather than a settled compliance position, so confirm the scope with your compliance advisor or healthcare attorney before you rely on it.

Either way, the vendor holds sensitive identity data: least-privilege access, your own account ownership, and a clear data-return clause matter regardless.

Whatever you outsource, keep three things inside the practice: the Administrator role, the clinician’s own logins, and a copy of the data.

CAQH is the clearest case.

The Practice Manager Module gives your office real power — enter the credentialing contact, practice locations, hospital affiliations and liability insurance once, then export to every provider’s profile — and it has roles: an Administrator, who can add other Administrators and Basic Users, and Basic Users, who cannot add or edit users.

Keep an Administrator seat in-house even while a vendor works in the account, so user access stays yours to grant and revoke.

Name your own credentialing staff as a contact on each clinician’s profile — a profile can list multiple credentialing contacts by location — so the credentialing contact on the profile is your practice, not only a vendor.

The clinician’s part stays the clinician’s: they import the data, authorize each plan and attest.

The module’s mechanics are covered step by step in our guide to CAQH for group practices.

The same logic runs through the federal systems.

A clinician can grant surrogate access in NPPES so your staff can apply for or update their NPI record — grant it to your practice, not only to a vendor, because the record belongs to your clinician, not to whoever holds a login.

On Medicare enrollment applications, name your own office or credentialing staff as the contact person; the contractor will discuss the pending application with that contact, so make it an inbox you own.

Then protect the practice against the relationship ending.

Before a vendor starts, inventory every account where your credentialing data lives and decide who owns each login.

Require periodic exports of application packets and profile data in a format you can keep.

Put the exit in writing — what you receive, in what format, and when — because the real cost of a credentialing vendor is not just the fee; it is how much of your operation lives in someone else’s logins.