Credentialing vs. privileging comes down to evidence versus permission. Credentialing collects and verifies a practitioner's license, education, training, work history, and malpractice record. Privileging is a hospital's decision, made by its governing body on the medical staff's recommendation, about which specific procedures and services that practitioner may perform in that hospital. Credentialing comes first, and privileging depends on it.
Hospitals do both, while health plans credential but never privilege. Medical groups sit in between, supplying the paperwork for each.
Credentialing vs. privileging: what is the difference?
Credentialing establishes that a practitioner is qualified in general, and privileging decides what that practitioner may do in one particular hospital. For credentialing, CMS surveyors expect each file to include a request for clinical privileges, evidence of current licensure, training and education, documented experience, and references on competence, and the medical staff may not decide on board certification alone, according to the CMS State Operations Manual, Appendix A.
Privileging answers a narrower question: qualified to do what, here? Under 42 CFR 482.22, medical staff bylaws must set criteria for the privileges granted to individual practitioners, and the governing body grants privileges based on the medical staff's review. CMS guidance adds that a hospital cannot grant privileges for procedures it does not perform, however skilled the practitioner.
Medical staff membership, often called appointment, is a separate decision. Some practitioners hold privileges without membership, and CMS surveyors ask how the medical staff oversees them.
How does the hospital privileging process work?
The medical staff verifies and reviews the application, its committees recommend, and the governing body makes the final decision. Committee names vary with each hospital's bylaws, but a typical file moves through five stages:
- Application. The practitioner applies and marks the requested privileges on the department's delineation form.
- Verification. The medical staff office, or a credentials verification organization acting for it, verifies license, training, board certification, work history, and references, and queries the National Practitioner Data Bank.
- Department review. The department chair and credentials committee weigh the request against the hospital's criteria and the applicant's experience.
- Recommendation. The medical executive committee recommends granting, limiting, or denying privileges.
- Decision. The governing body, or a committee it has delegated, decides.
The Joint Commission's summary of hospital board requirements lists the criteria behind those steps: current licensure and relevant training verified with the primary source, evidence of physical ability to perform the privilege, peer recommendations, practice data from organizations that currently privilege the applicant when available, and, at renewal, performance within the hospital. The Joint Commission's January 2026 renumbering of its medical staff standards left those requirements the same, according to its Accreditation 360 briefing. For how each item gets verified, see our guide to primary source verification.
What is delineation of privileges, and are core privileges allowed?
Delineation of privileges means spelling out, procedure by procedure or in defined groups, what a practitioner may do. CMS guidance says bylaws must clearly list the privileges available to each category of practitioner, but no one receives the full list automatically: each practitioner's ability to perform each privilege has to be assessed individually.
Core privileging bundles the routine work of a specialty into one request, and anything outside the core is requested separately. The Joint Commission neither defines nor prohibits the model, according to its FAQ on core privileging, but the core may list only procedures the organization performs, competence must be evaluated for every item in it, and applicants need a clear way to strike items. If the hospital finds a gap, it grants a modified core and tells the applicant exactly what changed.
What are FPPE and OPPE, and when does each apply?
Focused Professional Practice Evaluation (FPPE) reviews performance in newly granted privileges, and Ongoing Professional Practice Evaluation (OPPE) is the continuing review of everyone who holds privileges. FPPE applies to privileges a practitioner has not yet shown competence in at your organization, and the Joint Commission's FPPE guidance requires it for every new privilege, for new applicants and for current staff adding privileges, with no exemption for board certification, experience, or reputation. It starts the day privileges are granted, temporary ones included, and the medical staff must define in advance how monitoring works and how long it lasts.
OPPE runs for as long as a practitioner holds privileges. The medical staff decides how often to collect data, but under the Joint Commission's OPPE guidance the data must be reviewed at least every 12 months. Each review feeds a decision to continue, limit, or revoke privileges, and a concern can trigger a focused review.
How often do hospitals reappoint and query the NPDB?
Reappointment comes at least every three years under Joint Commission standards, and NPDB queries are required at least every 2 years regardless. The CMS Conditions of Participation require periodic appraisals without naming an interval, and CMS's interpretive guidance recommends at least every 24 months where state law sets no timeframe. The Joint Commission's reappointment guidance allows up to three years from the previous appointment date, or less if law or regulation requires, and bylaws or state law may set a shorter cycle, so check both before moving to three years.
The National Practitioner Data Bank runs on its own clock. According to the NPDB Guidebook, hospitals must query when a practitioner applies for appointment or privileges (temporary privileges included), when a practitioner asks to add or expand privileges, and every 2 years for everyone on staff or holding privileges. NPDB reminded hospitals in April 2023 that the 2-year mandate stands even when an accreditor allows 3-year evaluations, and enrollment in Continuous Query satisfies it. Our article on NPDB queries covers the mechanics.
When can a hospital grant temporary or expedited privileges?
The Joint Commission's temporary privileges FAQ allows them in two situations: to meet an important patient care need, or for a new applicant whose complete application raises no concerns while it awaits medical executive committee and governing body approval. New-applicant temporary privileges last no more than 120 consecutive days. A patient care need, such as covering an absent physician with a locum tenens, must be documented in the credentials file.
Temporary privileges are not a patch for a late reappointment. The same FAQ says a failure to process a reappointment on time does not justify them unless stopping that practitioner would itself create an important patient care need, judged case by case, such as at a hospital with only three anesthesiologists.
Expedited privileging means full privileges, approved faster. Under Joint Commission standards, the governing body may delegate decisions to a committee of at least two voting members of the governing body, using criteria the medical staff develops. A NAMSS summary of the standard notes that an incomplete application or an adverse or limited medical executive committee recommendation rules out the expedited route, and that licensure challenges, involuntary loss of privileges, or an unusual pattern of malpractice judgments usually do too.
How does telemedicine credentialing by proxy work?
Credentialing by proxy lets a hospital's medical staff rely on another organization's credentialing and privileging decisions for telemedicine practitioners. Under 42 CFR 482.22(a)(3), the written agreement must ensure that the distant-site hospital participates in Medicare, the practitioner holds privileges there and appears on a current privilege list it supplies, and the practitioner holds a license issued or recognized by the state where the patients are. The receiving hospital must review the practitioner's performance and send the distant site, at minimum, all adverse events and complaints for use in periodic appraisal.
When the distant site is a telemedicine company rather than a hospital, paragraph (a)(4) also requires the company's credentialing and privileging process to meet the hospital standards in 42 CFR 482.12(a)(1) through (a)(7) and 482.22(a)(1) through (a)(2). Telehealth companies that staff hospital service lines should build around that condition; licensure is covered in our guide to telehealth credentialing across state lines. The Joint Commission adopted similar telemedicine standards after CMS's 2011 rule, according to the Center for Connected Health Policy, and its 2026 renumbering left them largely unchanged.
How do credentialing, privileging, and payer enrollment compare?
Credentialing proves qualifications, privileging grants permission at one facility, and payer enrollment makes a provider billable with a payer, each on its own schedule and often with a different owner. This table lines them up.
| Process | Who does it | What it proves | How often | Typical owner |
|---|---|---|---|---|
| Credentialing | Hospitals, health plans, and CVOs working for either | Identity, license, education, training, work history, and malpractice and disciplinary history check out | At appointment and each reappointment; health plans every three years under NCQA | Medical staff office or plan credentialing department |
| Privileging | Medical staff recommends; governing body grants | Competence to perform specific procedures at one facility | At appointment, when privileges are added, and at renewal (up to three years under the Joint Commission; CMS recommends at least every 24 months); OPPE review at least every 12 months | Medical staff office, department chairs, and the medical executive committee |
| Payer enrollment | Payer enrollment and contracting teams, using the group's submissions | The provider is enrolled or contracted and can bill that payer | At hire, when practice details change, and at revalidation (every 5 years for most Medicare providers) | Group revenue cycle or enrollment team |
The intervals come from NCQA for health plan recredentialing and 42 CFR 424.515 for Medicare revalidation. Enrollment has its own pitfalls, covered in credentialing vs. payer enrollment.
What should medical groups do when providers need hospital privileges?
Treat privileging as its own workstream with its own start date, because it runs on the hospital's committee calendar rather than yours. These habits keep it from holding up a first day.
- Start privileging when the offer is signed. Run it alongside payer enrollment, not after it. A file that misses one board meeting waits for the next, and temporary privileges only bridge the gap for a complete application that raises no concerns, for 120 days at most.
- Keep the verified file ready to share. The hospital verifies credentials itself, but a complete packet speeds the work: licenses, DEA registration, board certification, training certificates, work history with gaps explained, case logs, and peer references. Keep dates identical across the CAQH profile, payer applications, and hospital applications.
- Know which payers expect admitting privileges or a coverage arrangement. UnitedHealthcare's 2025 to 2027 credentialing plan, for example, requires full admitting privileges at one or more network hospitals, or an arrangement with a participating practitioner to admit and cover patients there, when it decides the applicant's practice requires hospital privileges. For clinicians who do not admit, put the arrangement in writing and name the admitting practitioner or hospitalist group.
- Track reappointment dates at every hospital. Three years is the Joint Commission's ceiling, and state law, CMS's 24-month recommendation, or bylaws may set a shorter cycle. When an appointment lapses, the physician cannot round or take call there until privileges are restored.
- Prepare new hires for FPPE. Every new privilege starts a focused review, so tell clinicians to expect chart review or direct observation and give the medical staff office their schedules early.
Groups that want help with the follow-up can hand it off. CredTek is a team of credentialing specialists that follows up with providers, payers, and boards on a fixed schedule and gives clients a portal to see every provider's status.
Frequently asked questions
Is credentialing the same as privileging?
No. Credentialing verifies qualifications such as license, education, training, work history, and malpractice history. Privileging uses those verified credentials, plus evidence of current competence, to decide which specific procedures a practitioner may perform at one hospital. A physician credentialed by a health plan still needs privileges at each hospital where they practice, and privileges at one hospital do not carry over to another.
How long can temporary privileges last?
For a new applicant whose complete application raises no concerns and is waiting for committee and board approval, the Joint Commission caps temporary privileges at 120 consecutive days. Temporary privileges granted for an important patient care need, such as covering an absent physician, require that need to be documented in the credentials file. In both cases, focused professional practice evaluation begins the day the temporary privileges start.
How often must a hospital query the NPDB?
Federal law requires a hospital to query the National Practitioner Data Bank when a practitioner applies for appointment or clinical privileges, including temporary privileges, when a practitioner asks to add or expand privileges, and every 2 years for everyone on the medical staff or holding privileges. The 2-year rule applies even if the hospital's accreditor allows a 3-year reappointment cycle. Continuous Query enrollment meets the requirement.
Does board certification exempt a physician from FPPE?
No. The Joint Commission requires a period of focused professional practice evaluation for every new privilege, whether the practitioner is new to the hospital or already on staff and adding a privilege. Its guidance states there is no exemption based on board certification, documented experience, or reputation. The medical staff decides in advance how monitoring works and how its length is determined.
Can a hospital rely on another hospital's credentialing for telemedicine physicians?
Yes, if the governing body chooses credentialing by proxy and the written agreement meets CMS conditions. The distant-site hospital must participate in Medicare, the physician must hold privileges there, the distant site must supply a current privilege list, and the physician must be licensed or recognized in the state where the patients are. The receiving hospital must send back adverse events and complaints for use in periodic appraisals.
See your own numbers in 60 seconds
CredTek is a team of master credentialers that plugs into your group in 48 hours and follows up with every provider, payer, and licensing board on a fixed schedule until each file is done, with your approval on every submission.
Run the ROI calculator →