NCQA Credentialing Standards: What Changed in 2025 and How to Stay Compliant

NCQA credentialing standards changed for files processed on or after July 1, 2025. Verification windows got shorter, but not evenly: NCQA's own table cuts most accredited-organization limits from 180 to 120 days, keeps license at 180, and cuts work history from 365 to 180, while certified CVOs move mostly to 90 days. Monitoring became monthly, and adverse-event monitoring now covers every practitioner.

When did the 2025 NCQA credentialing changes take effect?

July 1, 2025. NCQA says an organization whose survey submission date falls on or after that date is assessed against the 2025 standards and expected to hold its delegates to them. The new verification limits apply to files processed on or after July 1, 2025, and earlier files are scored against the old limits.

"Processed" has a defined meaning. In a January 2025 FAQ, NCQA said it means the credentialing decision date for Health Plan, MBHO and Credentialing Accreditation, and the date verifications are reported to the client for Credentialing Certification. A file your committee approved on June 30, 2025 lives under the old limits, and one approved on July 1 lives under the new ones.

The program structure changed as well. In an August 2024 announcement, NCQA folded Credentialing Accreditation and CVO Certification into a single credentialing program, with separate certifications for individual credentials such as license to practice, and added an interim survey for organizations new to NCQA. Its 2025 program guide says the interim option gives a new organization 18 months to reach full accreditation, and that certification now runs on a 3-year status cycle.

What are the new NCQA verification time limits?

They depend on the element and on whether you hold accreditation or certification. Many summaries of the NCQA 2025 credentialing changes say every limit fell from 180 to 120 days for accredited organizations and from 120 to 90 for a credentialing verification organization. NCQA's documents show a less uniform picture, and the table below uses only them: the before figures come from NCQA's overview of the proposed changes, which listed the limits then in force, and the after figures from its 2025 credentialing program guide.

The work history numbers are confirmed twice. NCQA's November 2024 corrections set work history at 180 days for Credentialing Accreditation, replacing 365, and a November 2025 notice confirms 120 days for certification, replacing 305. The same 180-day correction appears in NCQA's Health Plan Accreditation notice for CR 3, so health plans should check each CR 3 factor in their own edition rather than assume one number.

NCQA's guide lists two more limits: Medicare and Medicaid exclusions at 120 days for accreditation and 90 for certification, and the application attestation at 180 and 120 days. NCQA posts corrections several times a year, so confirm each factor in the Interactive Review Tool for your survey year before you rebuild your tracking.

The clock runs backward from the decision. At an accredited organization, count from each verification date to the credentialing decision date; at a certified CVO, count to the date it reports the verification to the client. That difference matters when you buy verifications from a CVO, as the checklist below shows.

How often does NCQA require ongoing monitoring of sanctions now?

At least monthly. Organizations review Medicare and Medicaid sanctions, exclusions, and license sanctions, limitations and expirations at least once a month, or within 30 calendar days of a new alert if they subscribe to a monitoring service. NCQA briefly replaced "monthly" with "every 30 calendar days" in July 2025, then retracted that wording in September 2025; it accepts either a calendar-month schedule or a 30-day interval for the 2025 and 2026 standard years.

Adverse events changed more. Under the 2025 standards, adverse-event monitoring moved from at least every 6 months to at least monthly on July 1, 2025, as NCQA's July 2025 notice spells out, and a September 2025 FAQ says it now has to cover all practitioners. Limiting it to primary care and high-volume behavioral health practitioners, which the 2024 standards allowed, is no longer acceptable.

Sanction and exclusion checks also apply to every practitioner in scope regardless of product line, which NCQA states plainly. The accepted sources, as revised in November 2025, are:

• Medicaid sanctions. Any of the state Medicaid agency, the AMA Physician Master File, FSMB, the NPDB or SAM.gov.
• Medicare sanctions. Any of the AMA Physician Master File, FSMB, the NPDB or SAM.gov.
• Medicaid exclusions. Any of the state Medicaid agency, the OIG List of Excluded Individuals and Entities (LEIE) or the NPDB.
• Medicare exclusions. Any of the Medicare Exclusion Database, the LEIE or the NPDB.

SAM.gov is one accepted source, not a mandate. NCQA added it to the standards as an acceptable source for Medicare and Medicaid sanctions, and it has said organizations may verify from any of the listed sources rather than all of them. Your state Medicaid contracts may ask for more, so check them; our guide to OIG and SAM exclusion monitoring covers a source-by-source routine.

One more change arrived for 2026. A March 2026 policy change tells organizations to monitor license sanctions and limitations in every state where the practitioner practices, even states outside the service area or where the practitioner does not treat your members. For a telehealth psychiatrist licensed in 12 states, that is 12 boards to check each month; our telehealth credentialing guide covers the licensing side.

How quickly do you have to act on what monitoring finds?

NCQA's published updates set the review clock, not a separate number of days to finish an intervention. What surveyors check under CR 5, Element B is whether findings reached the credentialing committee or another designated peer-review body, and whether action followed. NCQA's July 2025 clarification says it reviews up to three sets of meeting minutes within the look-back period, plus reports showing the organization acted on quality and safety issues, with a 6-month look-back for the reporting piece at renewal surveys.

That leaves the pace to your own policy, so put it in writing. Route license actions and exclusions to the medical director as soon as they are found, and define which monitoring findings need committee review and by which meeting.

Did the 36-month recredentialing cycle change?

No. NCQA still requires recredentialing every three years, a 36-month cycle, and a standing NCQA FAQ says an organization cannot extend that cycle because a file ran late. The exceptions NCQA recognizes are situations such as active duty military assignment and medical leave.

What changed is the cost of starting too early. With board certification and malpractice history now good for 120 days at an accredited organization, a recredentialing file assembled five months before the committee date will need those items verified again. For surveys under the 2026 standards, NCQA also lists self-identified systemic problems affecting 5% or more of eligible credentialing files, with late recredentialing as its example, among the events organizations report to NCQA. Our guide to recredentialing every three years covers cycle planning.

What else changed in the 2025 NCQA credentialing standards?

Smaller changes reached the application and the audit program, and NCQA clarified how compact licenses count. Check each one against your current application, audit plan and license verification policy.

• Race, ethnicity and language on the application. The application must include fields for each, with a statement that the organization does not discriminate and that answering is optional. NCQA scores applications processed on or after July 1, 2025 on this factor, with the full look-back enforced from January 1, 2026, and it accepts the updated application from CAQH (now DataSpring), which added the fields effective July 1, 2025.
• Information integrity instead of system controls. A new information integrity training requirement means delegation agreements signed before July 1, 2025 must be amended if the delegate handles that training. The annual information integrity audit must also cover committee minutes and ongoing monitoring reports for the sampled practitioners, not just verification data.
• Compact licenses. A November 2025 clarification lets organizations accept licensure under an interstate compact when the license was primary source verified in the practitioner's home state.

How do you bring your credentialing program into compliance?

Start with the files you will decide in the next 90 days, then fix the structure behind them. The first two steps protect files already in flight, and the rest keep the next survey clean.

1. Recalculate the windows on every open file. For each element, add the new limit to the verification date and compare the result with the scheduled committee date. Anything that expires first gets re-verified before the meeting, not after approval.
2. Set committee dates first, then time the verifications. Work backward from each meeting so the 120-day items (board certification, malpractice history, sanctions and exclusions) land inside their window and the 180-day items (license, work history) inside theirs. If you buy from a certified CVO, its 90-day limit is measured when it reports to you while your own clock keeps running: a board certification verified 85 days before delivery leaves you 35 days to reach committee.
3. Put monitoring on a written monthly calendar. Pick a calendar-month schedule or a 30-day interval, name the source for each check, and cover every state license and every product line. Include adverse events for all practitioners and keep dated evidence of each run; OIG publishes monthly supplements to its exclusion list, which fits a monthly routine.
4. Bring delegation oversight up to date. Hold delegates to the 2025 standards, add the information integrity training language, and note that NCQA's 2026 notice requires delegation agreements for surveys starting on or after July 1, 2027 to address CR information integrity. In delegate file audits, score each file by its processed date: before July 1, 2025 against the 2024 limits, after it against the 2025 limits. Our guide to NCQA delegated credentialing covers the oversight cycle.
5. Use certified CVOs where they save work, and hold them to written targets. NCQA's guide says a client using an NCQA-certified CVO skips the predelegation evaluation, semiannual reports, annual evaluation and annual file audit for the certified elements, but NCQA still assesses the client on the timeliness of its credentialing decision. In MGMA's November 4, 2025 poll, 65% of medical groups said their credentialing, recredentialing and reappointment files were on time, and groups that stayed on time pointed to enough staff, a clear checklist, some automation and written CVO turnaround targets.
6. Audit your own files against the new rules. Sample recent decisions and check verification ages against the decision date, the race, ethnicity and language fields on applications processed after July 1, 2025, and the monitoring evidence between cycles. Our checklist for an audit-ready credentialing file lists what each file should hold.

If your team is short on hands for this, bring in help before the next committee cycle rather than during the survey. CredTek is a team of credentialing specialists that follows up with providers, payers and boards on a fixed schedule and gives clients a portal to see every provider's status.