How to Choose a Credentialing Company: 12 Questions to Ask Before You Sign

To choose a credentialing company, ask every finalist the same 12 questions and get the answers in writing: how they measure turnaround, who works your files, how you see status, how often they follow up, what the monthly fee covers, which SLAs they will sign, and what happens to your data when you leave. Then call references who look like you.

The stakes are measurable. In a November 4, 2025 MGMA Stat poll, 65% of medical groups said their credentialing, recredentialing and reappointment files were on time, while 23% reported a backlog, 6% expected work to slip into the first quarter and 3% cited a CVO delay. Most delays traced to payer enrollment and slow references and board verifications, made worse by thin staffing, disorganization and slow vendor turnaround.

How do you compare credentialing companies on speed?

Judge them on the steps they control, timed from receipt of a complete packet, and get the targets in writing. Payers own review time, and the vendor owns the work around it.

1. When does your turnaround clock start, and what are your results by payer?

Some firms start the clock at submission, which hides the days a file sits in intake, and those days cost money. For Medicare, a practitioner's effective date is the later of the filing date of the approved application or the date services began at the new location (42 CFR 424.520), and retrospective billing reaches back only 30 days, and only when circumstances prevented enrolling in advance.

A good answer: the clock starts at a complete packet, and they can show intake-to-submission in business days plus the median time from application to effective date for each payer in your states over the past year. Compare those figures with our payer enrollment timelines. Red flag: one blended average they cannot break out by payer.

2. Will you commit to turnaround targets in a written SLA?

Groups that stayed on time in the MGMA poll credited a few habits, and one was holding their CVOs to written turnaround targets. The SLA should cover what the vendor controls: days from complete packet to submission, the interval between payer follow-ups, response time to your questions and how often you get a status report.

A good answer: specific numbers in the contract, a monthly report against them and a remedy for misses. Red flag: "Payers control the timeline, so we can't commit," which is true of approval dates and false of everything the vendor does around them.

3. How often do you follow up with payers and with our providers?

Files rarely fail loudly. They sit in a payer queue, or wait on a provider who never sent a current malpractice certificate, and MGMA respondents named slow provider responses and missing documents among their delay causes.

A good answer: a fixed interval for every open application, each contact logged with a reference number and next step, and scheduled provider reminders that escalate to you when someone goes quiet. Red flag: "We follow up as needed."

Who works your files at an outsourced credentialing company?

At a well-run firm, a named specialist owns your files, and you can check any file's status yourself. Ask to meet that person before you sign.

4. Will our files have a named owner or sit in a shared queue?

Every handoff in a queue loses context, such as the payer representative who promised a callback or the provider who only answers texts. A specialist who knows your roster and payer mix spots trouble before it becomes a denial.

A good answer: a named specialist, a named backup for vacations and a straight answer about each specialist's caseload. Red flag: a general support inbox as your main contact.

5. How will we see status without emailing you?

If learning where a file stands means emailing and waiting, you will spend your week asking. You want a portal that shows, for every provider and payer, the current step, the submission date, the last follow-up and what is outstanding from whom.

A good answer: a live walkthrough of a de-identified client view. MGMA's write-up of the poll also recommends asking vendors for the age of their oldest open file, how many files are lagging and the plan to clear them, so ask for those numbers monthly. Red flag: a status field that only ever says "in progress."

What does outsourced credentialing include, and how is it priced?

A common structure for credentialing service pricing is a monthly per-provider fee for maintenance plus a per-provider quote for credentialing and enrolling each new hire. The next two questions show exactly where that line falls.

6. What does the monthly fee cover, and what is quoted per new provider?

Maintenance keeps current providers billable: payer recredentialing, which NCQA requires every three years; Medicare revalidation, generally every 5 years; CAQH re-attestation; expirables such as licenses, DEA registrations and malpractice policies; and exclusion screening. In a 2009 letter, CMS told state Medicaid agencies to require providers to search the OIG exclusion list monthly, so ask how often the vendor checks.

New-hire work, meaning the credentialing file, the CAQH profile and each payer enrollment, is often quoted per provider. Ask whether that fee covers every payer or is charged per application, and whether hospital privileges, new state licenses and facility enrollments are included.

A good answer: an itemized schedule of what the monthly fee includes and what each new provider costs, with nothing else billable unless it is listed. Red flag: maintenance billed task by task. To weigh a quote against staffing the work yourself, see what in-house and outsourced credentialing really cost.

7. Who manages CAQH, and how do you keep attestations current?

CAQH, which rebranded as DataSpring in June 2026, still runs the CAQH Provider Data Portal (formerly ProView) on a 120-day attestation cycle. A lapsed attestation is one of the easiest ways to stall a clean application, so it belongs in the vendor's scope rather than a provider's memory.

A good answer: they track every attestation date, remind providers well before day 120, confirm completion and keep documents and plan authorizations current, as our CAQH attestation guide describes. Red flag: "CAQH is the provider's responsibility."

Does the credentialing vendor know your states and specialties?

You can tell only from named, recent work with the payers and state Medicaid programs you bill, for your license types. General answers are not enough, because Medicaid rules differ by state.

8. What have you done recently in our specialties and states, including Medicaid managed care and behavioral health carve-outs?

Federal rules require each state to screen and enroll every managed care network provider, and a plan may contract with a provider pending that enrollment for only 120 days. Each state also sets a uniform credentialing policy that its plans must follow, so the same file can face different rules in two states.

Behavioral health adds a layer. A KFF survey of state Medicaid programs, published in 2023, found that most states with managed care carved most behavioral health services into their main plan contracts, while fewer carved them out to separate plans or fee-for-service or varied by region. Your vendor must know who credentials your clinicians in each state and how pre-licensed clinicians under supervision are handled, which our behavioral health credentialing guide covers.

A good answer: named payers and state Medicaid programs they enrolled providers with in the past year, for your license types. Red flag: "We work in all 50 states," with no examples.

What should a credentialing company do when an application stalls or is denied?

It should escalate on a schedule you agreed to in advance and tell you within days when a file goes quiet or is denied. The next monthly report is too late.

9. What happens when a payer denies an application or sends no update for 60 to 90 days?

Get the escalation path in writing: routine follow-up, then a supervisor or provider-relations contact at the payer, then your contracting lead, plus whatever help state law offers. In New York, a plan must tell a practitioner within 60 days of a completed application whether they are credentialed or why it needs more time, and certain newly licensed or newly relocated clinicians who join a group whose members all participate can be treated as provisionally credentialed if the plan has not decided by then (Public Health Law 4406-d).

Denials need a diagnosis first, because a closed panel calls for a different response than a missing document, and our guide to why credentialing applications stall covers each fix. A good answer: a defined trigger, such as 30 days without a meaningful payer update, and a call to you the same week any denial arrives. Red flag: you learn about a denial from a rejected claim.

How do you protect your data when you outsource credentialing?

Put data ownership, export and exit terms in the contract, and keep system accounts in your organization's name. If the vendor will handle protected health information, sign a business associate agreement first.

10. Who owns our data, and what happens when we leave?

Provider files, application histories and payer correspondence should belong to you and be exportable at any time, documents included. Check notice periods, auto-renewal and termination fees, and ask whether open applications are handed over with a status note for each.

Account ownership matters as much. In CMS's enrollment systems, your Authorized Official or Access Manager can invite a vendor as a surrogate or staff end user, and those users cannot sign enrollment applications or manage staff. Keep PECOS, CAQH and payer portal accounts in your organization's name, with the vendor as a user you can remove.

A good answer: you own the data, export is free on request and at exit, and there is a defined transition period. Red flag: export fees, or logins that exist only in the vendor's name.

11. Will you sign a business associate agreement?

Credentialing files are mostly about providers, not patients, but a vendor can still touch protected health information through payer portals or malpractice claim details. When it does, HIPAA requires a written business associate agreement that obliges the vendor to report breaches and, where feasible, return or destroy the information when the contract ends. HHS has also said a business associate may not block your access to that information to settle a payment dispute.

Provider Social Security and DEA numbers are generally not protected health information, so the contract's security terms should cover them too. A good answer: a signed BAA before any data moves, plus clear answers on encryption and access controls. Red flag: "We don't need a BAA," said before anyone asks what data you will share.

How should you check a credentialing vendor's references?

Ask for references that match your size, specialties and states, each credentialed with the firm in the past 12 months. Ask them for numbers rather than impressions.

12. Can we talk to groups like ours that you credentialed in the last 12 months?

Old references describe an old team, while recent ones show the firm as it works now. Ask each reference how long recent enrollments took from packet to effective date, how often they had to chase the vendor for status and whether they would sign again.

A good answer: references within days, including one group that has been through recredentialing with the firm. Red flag: testimonials instead of phone numbers.

What does a credentialing company scorecard look like?

It fits on one page, with each question, the answer to listen for and the warning sign. Score every finalist on the same sheet and keep their written answers with the contract.

Put the same 12 questions to every finalist, CredTek included. A team that follows up with providers, payers and boards on a fixed schedule, and shows clients every provider's status in a portal, should be able to answer each one in writing, with numbers.