NCQA's 120-day verification window reset the credentialing calendar

NCQA’s 120-day verification window reset the credentialing calendar for accredited health plans. A credentialing file has a shelf life. When a plan verifies a physician’s license and board certification, those verifications start aging, and an accredited plan has a fixed number of days to make its credentialing decision before it has to verify them again. Until last summer that number was 180 for plans accredited by the National Committee for Quality Assurance (NCQA). Since July 2025, it has been 120.

The same update replaced periodic checks between recredentialing cycles with ongoing monitoring at least every 30 days. Accredited organizations now have to check exclusion and sanction sources every month, including the federal System for Award Management. They must also track license expiration dates monthly and route adverse findings to a credentialing committee or other peer review body.

Neither change sounds dramatic on its own. Together they move credentialing from a periodic file review toward a continuous process with tighter deadlines. They also put pressure on the parts of the process that plans control least, such as how quickly primary sources respond and how quickly delegates deliver. This analysis looks at what changed and how the new requirements fit with federal credentialing and enrollment rules. It closes with where plans are feeling the effects.

Key takeaways

• The verification window shrank by a third. For NCQA-accredited organizations, the time allowed between verification and the credentialing decision fell from 180 days to 120. For NCQA-certified credentials verification organizations, it fell from 120 days to 90.
• Monitoring is now monthly. Exclusions and sanctions must be checked at least every 30 days, with SAM.gov added as a source and license expiration tracked monthly.
• The changes took effect in July 2025. NCQA finalized them in August 2024 after a public comment period that drew about 1,500 comments from 65 organizations.
• Federal rules still set a 3-year floor. Medicare Advantage plans must recredential at least every 3 years under 42 CFR § 422.204. Medicaid managed care plans follow a uniform policy set by each state under 42 CFR § 438.214.
• Medicare enrollment is a separate clock. Most providers revalidate their Medicare enrollment every 5 years, and CMS can require off-cycle revalidation. A plan’s credentialing file does not show whether that enrollment is still active.
• The bottleneck has moved. With less time on the clock, a slow application or a late committee decision now risks expiring verifications rather than merely slowing onboarding.

What changed in July 2025

NCQA publishes standards for health plan accreditation and for certification of credentials verification organizations (CVOs), among other programs. It revises them periodically. The 2025 changes to credentialing were finalized in August 2024 after a 6-week comment period, according to a summary by ProviderTrust, a monitoring vendor, which reports that NCQA received about 1,500 comments from 65 organizations.

The table lists the changes most organizations have had to absorb.

Compiled from summaries of NCQA’s 2025 credentialing updates by ProviderTrust and Verifiable. NCQA’s standards documents were not reviewed directly for this analysis.

A HealthStream summary describes the shortened windows as applying to verifications such as licenses and board certifications. It frames the update as an effort to keep provider data current and strengthen monitoring between cycles. Verifiable’s summary notes that the update also added language on race and ethnicity data, without giving detail.

What the 120-day clock measures

The verification time limit does not measure how long credentialing takes from application to decision. It measures how old the verifications can be when the decision is made. If a plan verifies a license on day 1 and the credentialing committee approves the clinician on day 130, the license verification has expired under the new standard and has to be repeated, even if nothing about the license changed.

That distinction shifts where the risk sits. Under a 180-day window, a file could wait for a missing document or a committee meeting for months before its earliest verification aged out. Under a 120-day window, the margin is smaller, and every source of delay after verification begins counts against it.

An illustrative file shows the pressure. Say a clinician submits an application with a missing malpractice history. The plan verifies the license and board certification right away, then waits 6 weeks for the malpractice information. Once that arrives, the plan verifies it and sends the file to a committee that meets monthly. If the file just misses a meeting, the decision lands near day 100. A single further delay, such as a committee question that requires a follow-up, and the earliest verifications approach the limit. Under the old standard, the same file would have had 2 months of slack.

The CVO window is shorter still. A plan that delegates verification to a certified CVO receives verifications that must be no more than 90 days old under the CVO’s own standard. The difference between 90 and 120 days is effectively the time a plan has to receive the CVO’s work and reach a decision before the verifications age out of the plan’s own window. How a plan uses that margin depends on its delegation agreement, but the arithmetic is tight for any organization that batches decisions.

Committee cadence becomes a compliance variable

The simplest response to a shorter window is to make decisions faster after verification. For many plans, that means looking at how often the credentialing committee meets and how much authority it delegates. A committee that meets monthly can leave a clean file waiting up to 4 weeks. Some organizations allow the medical director or a designee to approve clean files between meetings, with the committee reviewing files that carry adverse information. Whether that approach fits a given plan depends on its policies and its accreditation reviewers, but the 120-day window gives it new urgency.

Monthly monitoring replaces a 3-year blind spot

The second change matters more over time. Before 2025, a credentialed clinician’s file was reviewed in full at recredentialing, which federal rules require at least every 3 years for Medicare Advantage. Between those reviews, monitoring depended on when sources published updates and on each plan’s policies. A license action or an exclusion could exist for weeks before the plan acted on it.

Under the 2025 update, organizations must monitor 4 kinds of sources at least every 30 days.

• Exclusions from Medicare and Medicaid, including federal and state exclusion lists.
• Sanctions and disciplinary actions taken by licensing boards.
• SAM.gov, the federal System for Award Management, which lists entities and individuals excluded from federal contracts and programs.
• License expiration dates, which must be tracked monthly for every practitioner who requires credentialing.

Adverse findings must go to the credentialing committee or another designated peer review body.

The stakes of a missed exclusion are concrete. According to the HHS Office of Inspector General, federal health care programs make no payment for items or services “furnished, ordered, or prescribed” by an individual or entity on its List of Excluded Individuals/Entities. OIG advises health care entities to check the list routinely, and employing an excluded person can lead to civil monetary penalties. A plan that learns of an exclusion months late may have paid claims it now has to unwind.

The scale is larger than the monthly cadence suggests. Each check runs against every credentialed practitioner. For illustration, a plan with 20,000 credentialed practitioners that checks 4 kinds of sources monthly runs 960,000 checks a year, before counting the state-by-state variation in exclusion lists and licensing boards. That figure is this analysis’s arithmetic for a hypothetical plan, not an industry estimate. At that volume, monitoring is a data pipeline, not a task a credentialing analyst performs by hand.

Credentialing used to be a file reviewed every 3 years. It is becoming a feed checked every month, and the work moves from reviewers to data.

How NCQA’s requirements fit with federal rules

NCQA accreditation is voluntary in principle and often required in practice, by states for Medicaid managed care contracts and by exchanges for qualified health plans. Federal rules set their own credentialing requirements, which NCQA’s standards sit on top of.

For Medicare Advantage, 42 CFR § 422.204 requires written policies for selecting and evaluating providers. For physicians and other health care professionals, initial credentialing must cover 5 elements.

• A signed application attesting to its accuracy
• Verification of licensure or certification from primary sources
• Disciplinary status
• Eligibility for Medicare payment
• Site visits as appropriate

Recredentialing must occur at least every 3 years and must consider performance indicators such as quality improvement data and enrollee satisfaction. MA organizations may not employ or contract with individuals excluded from Medicare, and they must have a process to comply with CMS’s preclusion list.

For Medicaid managed care, 42 CFR § 438.214 requires each state to set a uniform credentialing and recredentialing policy that its plans follow, covering behavioral health and long-term care providers as well as acute and primary care. Plans may not contract with excluded providers, and they must remove providers terminated from Medicare or Medicaid.

Compiled from summaries of NCQA’s 2025 updates and the text of 42 CFR § 422.204 and 42 CFR § 438.214.

The federal rules say what must be checked. NCQA’s update says how often and how fresh. For a plan with several lines of business, the practical effect is that the strictest timing requirement, usually NCQA’s, sets the operating standard for the whole network.

Delegation multiplies the clock

Many plans delegate credentialing to large medical groups or CVOs. For Medicare Advantage, delegation comes with conditions. Under 42 CFR § 422.504(i)(4), if an MA organization delegates credentialing, it must either review the credentials of the delegate’s medical professionals itself or review and approve the delegate’s credentialing process and audit that process on an ongoing basis. The MA organization keeps ultimate responsibility for its contract with CMS regardless.

A shorter verification window turns that oversight into a scheduling problem. When a delegate completes verifications and sends the plan a roster of approved clinicians, the plan’s own clock is already running on verifications it did not perform. If the delegate batches its work quarterly, or the plan’s intake of delegated files takes weeks, the verifications can age past the plan’s limit before the plan has loaded them. Delegation agreements written for a 180-day world rarely set delivery times that fit inside 120 days.

The fix is contractual as much as operational. Agreements can set a maximum age for verifications at delivery, along with a file format the plan can load without rekeying. Plans that audit delegates annually against those terms will see problems before an accreditation survey does.

Medicare enrollment runs on a separate clock

A clinician can be fully credentialed by a plan and still lose the ability to bill Medicare. Medicare enrollment is maintained by CMS, not by plans, and it has its own cycle. Under 42 CFR § 424.515, most providers and suppliers must resubmit and recertify their enrollment information every 5 years. CMS contacts providers when revalidation is due, and they have 60 calendar days to submit. CMS can also require revalidation outside the regular cycle, prompted by random checks or by information about local health care fraud, and off-cycle revalidations may include site visits. Durable medical equipment suppliers follow separate renewal rules.

That matters to plans for 2 reasons. Medicare Advantage credentialing under 42 CFR § 422.204 includes verification of eligibility for Medicare payment, so enrollment status is part of what a plan attests to at credentialing. And enrollment can lapse between a plan’s recredentialing cycles, for instance when a provider misses a revalidation deadline. The monthly monitoring NCQA now requires covers exclusions and licenses, not enrollment. A plan that wants its network data to reflect who can actually be paid has reason to watch enrollment status and CMS’s preclusion list on the same cadence.

Where the time goes

If the clock is shorter, the question for any credentialing operation is where its days are spent. Most of the time in a credentialing file is not verification itself. Primary source checks for licenses and board certification are often fast when done electronically. The slow parts tend to be the steps around verification.

Incomplete applications. A file cannot be decided until it is complete, and a missing attestation or malpractice history can take weeks to resolve. Every day spent chasing a document after the first verification counts against the 120 days.

Sources that do not respond electronically. Some verifications, such as certain education or training confirmations and some work history checks, still depend on letters and phone calls. These set the pace for the whole file.

Committee scheduling. As above, a monthly committee can consume a quarter of the window on its own.

Delegation hand-offs. When a medical group or CVO performs verification under delegation, the plan depends on the delegate’s timing and on how quickly files move between organizations.

Rework from expired verifications. Each re-verification adds work ahead of the next file in line. An operation that lets a few files expire each month carries that rework forward, and the backlog grows on its own. Counting how many verifications are repeated, and why, is the most direct way to see whether a team is working with the window or against it.

The 120-day window does not change any of these. It changes the cost of each one. Under 180 days, a slow step delayed onboarding. Under 120, a slow step can force re-verification, which adds work and resets part of the clock.

What the shorter window means for networks

Credentialing determines when a clinician can see a plan’s members as an in-network provider. Faster decisions can mean members get access to new clinicians sooner. Slower ones leave practices treating patients out of network or waiting to bill. A shorter verification window does not by itself make credentialing faster. It makes slow credentialing more expensive.

We see 3 effects worth tracking.

Onboarding times. Plans that redesign around the window, by fixing application completeness up front and deciding clean files without waiting for a monthly meeting, may see faster onboarding. Plans that do not may see more re-verification and longer delays.

Directory accuracy. Monthly monitoring and license tracking produce a steady flow of status changes. Plans that connect that flow to their provider directories can remove clinicians who are no longer eligible faster. Plans that do not will hold accurate credentialing files behind inaccurate directories.

Vendor contracts. CVO agreements and monitoring services written for a 180-day world may need new turnaround commitments. A CVO that delivers verifications at day 85 of its 90-day window leaves the plan very little of its own.

What to watch in 2026

First survey cycles under the new standards. Plans surveyed for accreditation in 2026 will be the first assessed on files decided under the 120-day window. Survey findings will show where organizations struggled.

Automation of monitoring. Monthly checks across several source types push plans toward automated monitoring. The quality of that automation, especially matching clinicians correctly across state lists that use different identifiers, will determine whether monthly monitoring catches problems or produces noise.

Telehealth and multistate practice. A clinician licensed in several states multiplies the licenses and state exclusion lists a plan must check every month. Networks that lean on telehealth will feel the monitoring load first.

Alignment with directory and network rules. Federal and state rules on provider directory accuracy and network adequacy increasingly expect timely updates. Credentialing data is one of the main inputs to both, which makes the monitoring changes relevant beyond accreditation.

Further NCQA updates. NCQA revises its standards regularly. Any further changes to the credentialing standards will build on a process that is already moving toward continuous oversight.

About this analysis

Basis. This analysis relies on vendor summaries of NCQA’s 2025 credentialing updates and on the text of the federal regulations cited, as published by the Legal Information Institute. The HHS Office of Inspector General’s exclusions page supplied the payment consequences of an exclusion. NCQA’s standards documents are available to purchasers and were not reviewed directly. Requirements are described as the cited summaries report them.

Data notes.

• The 120-day and 90-day windows apply to NCQA-accredited organizations and NCQA-certified CVOs respectively, as reported in the summaries cited.
• The illustrative credentialing timeline and the count of 960,000 monitoring checks are hypothetical examples constructed for this analysis, not measurements.
• State Medicaid credentialing policies vary. The comparison table describes the federal requirement that states set a uniform policy, not the content of any state’s policy.
• The suggestions on delegation agreements and enrollment monitoring are this analysis’s interpretation of the requirements, not NCQA or CMS guidance.

Sources

• ProviderTrust, Unpacking the 2025 NCQA credentialing guideline updates, November 20, 2024
• Verifiable, Get ahead of the 2025 changes to NCQA credentialing guidelines, August 28, 2024
• HealthStream, NCQA’s 2025 credentialing updates
• Legal Information Institute, 42 CFR § 422.204, Provider selection and credentialing
• Legal Information Institute, 42 CFR § 422.504, Contract provisions
• Legal Information Institute, 42 CFR § 424.515, Requirements for reporting changes and updates to and the periodic revalidation of Medicare enrollment information
• Legal Information Institute, 42 CFR § 438.214, Provider selection
• HHS Office of Inspector General, Exclusions program

Frequently asked questions

What is NCQA’s verification time limit for credentialing in 2026?

Since July 2025, NCQA-accredited organizations must make credentialing decisions within 120 days of verification, down from 180. NCQA-certified CVOs have 90 days, down from 120.

How often does NCQA require ongoing monitoring of practitioners?

At least every 30 days. Organizations must check exclusion and sanction sources, including SAM.gov, and track license expiration dates monthly.

How often must Medicare Advantage plans recredential providers?

At least every 3 years under 42 CFR § 422.204. Recredentialing must consider performance data such as quality improvement and enrollee satisfaction.

How often do providers revalidate Medicare enrollment?

Most providers and suppliers revalidate every 5 years under 42 CFR § 424.515, and CMS can require off-cycle revalidation.