A healthcare credentialing checklist tells your medical staff office exactly which documents to collect from a provider before they can see patients, bill payers, or get hospital privileges. Skip a single item and the application gets kicked back, the provider sits idle for weeks, and revenue stalls. This guide gives you the full list — primary source documents, expirables to track, and the workflow that keeps re-credentialing from becoming a fire drill every two years.
We’ve kept it practical: the documents, why each one matters, and how to actually collect them without sending 40 emails per provider.
The complete healthcare credentialing checklist
Use this as your master list. Most payers and hospitals will ask for some subset of these — collect them all once, store them centrally, and re-use across applications.
| # | Document | Verify against | Expires |
|---|---|---|---|
| 1 | State medical license | State medical board | Yes (1–3 yrs) |
| 2 | DEA registration | DEA database | Yes (3 yrs) |
| 3 | State controlled substance registration | State pharmacy board | Yes |
| 4 | Board certification | ABMS / AOA | Yes (varies) |
| 5 | Medical school diploma | School registrar | No |
| 6 | Residency / fellowship certificates | Program director | No |
| 7 | ECFMG certificate (IMGs only) | ECFMG | No |
| 8 | Curriculum vitae (CV) | Self-attested | Refresh yearly |
| 9 | Malpractice insurance certificate | Carrier | Yes (1 yr) |
| 10 | Malpractice claims history | NPDB | Refresh yearly |
| 11 | NPI confirmation | NPPES | No |
| 12 | Hospital privileges letter | Each facility | Refresh yearly |
| 13 | Government-issued photo ID | — | Yes |
| 14 | Current life support certifications (BLS/ACLS/PALS) | Issuing body | Yes (2 yrs) |
Save the table somewhere your team can edit it. Every payer adds a quirk or two — a CAQH attestation here, a flu shot record there — but these 14 cover roughly 90% of what gets requested.
Identity, education, and training documents
These don’t expire, but you need clean copies on file because almost every credentialing application asks for them again.
1. Medical school diploma. Required by every payer and hospital. If the provider graduated from an international medical school, the credentialing application will likely also request the ECFMG certificate.
2. Residency and fellowship completion certificates. One per program. The provider’s CV will list these, but the actual certificates are what the credentialing committee wants to see.
3. Government-issued photo ID. Driver’s license or passport. Some health plans accept either; some require a passport for primary source verification of identity.
4. Curriculum vitae (CV). Continuous work history from medical school onward, no gaps longer than 30 days. Any gap needs a written explanation. This is the #1 reason applications get returned — small gaps the provider didn’t think to flag.
5. ECFMG certificate. Only for international medical graduates. Once issued, it doesn’t expire, but you’ll need a copy on file for every application.
Licenses, registrations, and certifications (the expirables)
This is where credentialing turns into a tracking problem. Every item below has an expiration date, and a lapsed credential blocks billing on day one.
6. State medical license. Required in every state where the provider practices. Renewal cycle varies — most states renew every 2 years, some annually, some every 3 years. Track renewal deadlines a minimum of 90 days out.
7. DEA registration. Federal authorization to prescribe controlled substances. Renewed every 3 years. The DEA number is state-specific — if a provider moves or starts practicing in a new state, they need a new DEA registration for that state.
8. State controlled substance registration (CSR). Some states require a separate state-level controlled substance registration on top of the federal DEA. Renewal cycles vary by state.
9. Board certification. Issued by the American Board of Medical Specialties (ABMS) for MDs or the American Osteopathic Association (AOA) for DOs. Maintenance of Certification (MOC) requirements differ by board.
10. Life support certifications. BLS for almost every clinical role, ACLS for hospital-based providers, PALS for anyone treating children, NRP for neonatal staff. All renew every 2 years.
These five are the documents your re-credentialing process exists to chase. If you only automate one part of credentialing, automate expiration tracking on these.
Insurance, claims history, and identifiers
11. Malpractice insurance certificate. The current declaration page showing carrier, policy number, effective dates, and coverage limits. Required by every payer. Renewed annually.
12. Malpractice claims history. A statement from the carrier listing all open and closed claims, plus a separate query of the National Practitioner Data Bank (NPDB). Pull the NPDB report fresh — most payers won’t accept a copy older than 60 days.
13. NPI confirmation. Print or screenshot from the NPPES registry showing the provider’s National Provider Identifier and taxonomy code. Make sure the taxonomy matches the specialty they’re being credentialed in — mismatched taxonomies trigger payer rejections.
14. Hospital privileges letter. A letter from each facility where the provider holds privileges, confirming current status, privilege category, and any restrictions. Refresh annually.
Re-credentialing: what to collect every 2 years
Re-credentialing happens every 24 to 36 months depending on the payer. The provider has likely renewed a dozen things since the initial application, and your job is to gather the current versions.
Plan for these specifically at re-credentialing:
- Current state medical license (and DEA, CSR) — fresh copies
- Updated malpractice insurance dec page
- New NPDB query (within the last 30–60 days)
- Updated CV with the last 24 months filled in
- Continuing medical education (CME) attestation
- Updated hospital privileges letters
- Re-attestation of any prior claims, sanctions, or disciplinary actions
The mistake most staff offices make is treating re-credentialing as a brand-new application. It isn’t. Pre-fill the application with what you already have, then collect only the deltas.
How to actually collect 14 documents from a provider without 40 emails
The checklist is the easy part. The hard part is getting a provider — who is busy seeing patients — to upload 14 separate files, attest to a stack of statements, and respond to questions inside of two weeks.
Email is where credentialing goes to die. Documents end up in three different threads, two team members chase the same provider, and nobody can tell you the real status of an application without opening the file cabinet.
A document collection platform like Superdocu solves this with a single branded portal per provider:
- The provider gets one link and uploads everything in one place
- Each document has its own request with instructions, examples, and validation rules
- Expiration dates are captured at upload so your team gets reminders before each license, DEA, or insurance certificate lapses
- Re-credentialing reuses the prior workflow — only the expired or new items need new uploads
- Hospital privileges letters and NPDB reports can be requested through repeatable workflow steps that fire automatically every 24 months
If this is the shape of your week, look at our wider guide on document collection best practices and how to collect documents from clients without email. Both apply directly to credentialing intake.
Frequently asked questions
What is a healthcare credentialing checklist?
A healthcare credentialing checklist is the master list of documents a medical staff office collects from a provider to verify their identity, education, training, licensure, and malpractice history before granting privileges or enrolling them with payers. Most checklists run 12 to 20 items.
How long does credentialing take?
End-to-end credentialing typically takes 60 to 120 days. The bottleneck is rarely the credentialing committee — it’s getting all the documents in from the provider and waiting for primary source verifications to come back. A complete, validated document packet on day one cuts the timeline significantly.
What’s the difference between credentialing and privileging?
Credentialing is the verification of a provider’s qualifications (license, education, malpractice history). Privileging is the hospital’s decision about which specific procedures and patient populations the provider is authorized to handle. Credentialing comes first; privileging builds on it.
How often do you need to re-credential?
Most payers and hospitals require re-credentialing every 24 months, though some run on a 36-month cycle. The Joint Commission and NCQA both set re-credentialing requirements that drive most of these timelines.
What documents need primary source verification?
State medical licenses (state board), DEA registration (DEA database), board certification (ABMS or AOA), medical school graduation (registrar or AMA Physician Masterfile), and malpractice claims (NPDB) all require primary source verification — meaning your office confirms them directly with the issuing authority, not just from a copy the provider sends.
Can you reuse credentialing documents across payers?
Yes. The documents themselves are the same — license, DEA, malpractice dec page, CV. What differs is the application form each payer requires. Collect documents once into a central portal, then attach them to whichever payer application is in flight.
Start your credentialing collection in minutes
Stop chasing providers for license copies and dec pages in your inbox. Superdocu gives every provider a branded portal where they upload, attest, and re-credential — and your team sees the status of every application in one dashboard, with automatic reminders before any credential expires.
Start your free Superdocu trial → (no credit card required)