What a Credentialing and Payer Enrollment Scope Must Contain

A quote that says “credentialing services” is not a scope. Enrollment fails at the edges: the re-attestation nobody owned, the revalidation notice that went to an old address, the effective date that never reached the billing system. The scope is where those edges are assigned to someone.

The deliverable is participation that pays

Credentialing and enrollment are bought to produce one result: a provider who is credentialed, enrolled under the right group and products, listed correctly, and paid in network from the earliest possible date, and who stays that way. Almost every failure is a lapse rather than a rejection: a profile that expired, a revalidation that was missed, a change that was not reported, a directory entry that was never verified, an approval letter that never reached the people who bill. Each of those has an owner only if the scope names one. The price matters, but the scope is what determines whether the result is delivered.

Provider data and the shared credentialing profile

The scope should list the documents the vendor will collect and maintain for each provider: licenses, DEA registration, board certification, malpractice coverage and history, education and training, work history and any gaps, hospital affiliations, identifiers, and tax documents. It should say who holds the originals, who is notified when one is about to expire, and how the provider supplies signatures and attestations.

Most commercial payers draw the application from the shared credentialing profile in the CAQH provider data portal, now operated by DataSpring, which is maintained on a 120-day attestation cycle. The scope should assign profile creation or audit, ongoing updates, and the re-attestation itself, and should say whether the vendor attests as the provider’s delegate or prompts the provider to attest. An expired profile stalls every payer that relies on it at once.

Medicare and Medicaid

Medicare enrollment is submitted through PECOS or on paper, and the Medicare Administrative Contractor may come back with requests for additional information while it processes the application. After enrollment, changes of ownership, adverse legal actions, and practice location must be reported within 30 days and other changes within 90 days. Providers and suppliers revalidate every five years, DMEPOS suppliers every three; the contractor sends a notice three to four months ahead, due dates are posted seven months ahead, and there are no exemptions or extensions. Missing the date can put a hold on reimbursement or deactivate billing privileges, and Medicare does not pay for services furnished while a provider is deactivated.

The scope should therefore name who monitors the revalidation list, where notices are sent, who reports changes and within what window, and who owns reactivation if it is ever needed. Medicaid enrollment is state-specific and separate from enrollment with Medicaid managed care plans; the scope should name the states, programs, and plans included.

Commercial payers and delegated credentialing

For each commercial payer the scope should name the products and networks applied for, whether the provider is being linked to an existing group contract or the group itself is applying for participation, and what happens when a panel is closed. Where a hospital, group, or other organization performs delegated credentialing, the scope should say which payers accept it and what the vendor does instead of a full application. Payers, products, and locations that are out of scope should be listed as plainly as those that are in.

After approval: the work that keeps providers paid

Approval is the middle of the process. The effective date and any participation identifiers have to reach the billing system and the people who use it, or claims will be filed under the wrong status. Electronic funds transfer and remittance enrollment follow the payer enrollment. Roster and demographic updates have to be sent to each payer, and directory information has to be kept accurate: federal law requires providers to submit directory information when a network agreement begins or ends and whenever it materially changes, and requires plans to verify their directories at least every 90 days and to remove providers they cannot verify. A provider who does not respond to a verification request can disappear from the directory while still enrolled.

Recredentialing cycles, license and certificate renewals, DEA and malpractice expirations, and periodic re-attestation continue for as long as the provider participates. The scope should say which of these the vendor tracks, how far ahead it acts, and how the practice is told.

Follow-up, reporting, and exceptions

Every application should have a follow-up cadence, a defined response to a returned or incomplete application, and an escalation path when a payer stops responding. Status reporting should name the fields (provider, payer, product, application date, status, last action, next action, effective date) and the frequency, and should be provided at a level that does not require patient information. Fees charged by payers, states, and programs are separate from the vendor’s fees, and the scope should say who pays them and how they are passed through. Licensing, hospital and surgery-center privileging, and payer contracting are distinct services; if they are wanted they should be written in, and if they are not they should be written out.

A scope checklist

A comparable credentialing quote answers each of the following in writing.

• Providers, locations, payers, products, states, and programs in scope, and those excluded
• Documents collected and maintained, and who holds them
• CAQH profile creation or audit, maintenance, and re-attestation ownership
• Medicare enrollment, change reporting, and revalidation monitoring
• Medicaid state enrollment and managed care plan enrollment
• Commercial applications, group linkage, closed-panel handling, and delegated credentialing
• Effective-date tracking and the handoff to the billing system and team
• Electronic funds transfer and remittance enrollment
• Roster, demographic, and directory updates, and responses to directory verification requests
• Expirables and recredentialing tracking, with lead times
• Follow-up cadence, returned-application handling, and escalation
• Status reporting: fields, frequency, and level of detail
• Third-party fees and how they are handled
• Definition of done, and what happens to open applications if the engagement ends

What this is not

Credentialing, enrollment, licensing, and privileging decisions are made by the payer, the board, or the organization, and no scope changes that. What a scope changes is whether every step that leads to those decisions, and every renewal that follows them, has a named owner.

Ellery Health Partners administers credentialing files, payer enrollment, licensing, and privileging under a written scope that names the providers, payers, programs, and facilities included, the follow-up cadence, the reporting, and the handoff to billing, with each application followed to the payer’s determination.

Related services

• Credentialing & Payer Enrollment
• Payer Contracting & Network Administration
• Claims & A/R Administration
• Denials & Appeals

Sources

• CMS, Revalidations (Renewing Your Enrollment). Providers and suppliers revalidate Medicare enrollment every five years, DMEPOS suppliers every three years; the enrollment contractor sends a revalidation notice about three to four months before the due date and CMS posts due dates seven months in advance; there are no exemptions and no extensions; failing to revalidate on time can result in a hold on reimbursement or deactivation of billing privileges, with no payment for services furnished during a deactivation.
• CMS, Medicare Enrollment for Providers & Suppliers. Providers enroll through PECOS or by paper application; the Medicare Administrative Contractor may request additional information while processing; changes of ownership, adverse legal actions, and practice location must be reported within 30 days and all other changes within 90 days.
• DataSpring (operator of the CAQH provider data portal), For Clinicians. Clinician profiles in the provider data portal are maintained on a 120-day attestation cycle.
• 42 U.S.C. § 300gg-139, Provider requirements to protect patients and improve the accuracy of provider directory information, via Cornell Legal Information Institute. Providers and facilities must submit provider directory information to a plan or issuer when a network agreement begins, when it terminates, when there are material changes to the information, and at other times determined appropriate.
• 42 U.S.C. § 300gg-115, Protecting patients and improving the accuracy of provider directory information, via Cornell Legal Information Institute. Group health plans and issuers must verify and update provider directory information not less frequently than once every 90 days and must have a procedure for removing a provider or facility whose information they have been unable to verify.

Sources are cited for the substantive factual statements above. Payer-specific rules vary by plan, product, contract, and state.

Last updated September 2026. Educational reference, not legal or clinical advice.