Credentialing vs Privileging: How to Onboard Providers Without Delaying Cash Flow

:::info Quick answer Credentialing verifies a provider’s qualifications, such as their medical license, education, and board certification, usually for payer enrollment. Privileging is a facility-specific process that dictates exactly which clinical procedures a provider is authorized to perform based on their proven competency and the facility's available resources. :::

Your practice just hired a brilliant orthopedic surgeon. She starts on Monday. She has an active state license, a clean DEA number, and her contract is signed. The front desk asks the billing manager, "Can we put her on the schedule for UHC patients next week?"

The billing manager groans. Without payer credentialing, those UHC claims will deny as out-of-network or simply bounce back. Meanwhile, the ambulatory surgery center (ASC) down the street asks, "Can she do robotic-assisted joint replacements here on Tuesday?" The medical director laughs. Without clinical privileging, she cannot legally touch a patient in that facility.

Most revenue cycle delays happen because practice managers blur the lines between credentialing vs privileging. They assume that if Medicare approves a provider's 855I form, the provider is ready to work. But that is only half the battle. In 2026, payers and accrediting bodies like The Joint Commission (TJC) are auditing these two separate processes tighter than ever. If you allow a provider to perform a CPT code they are not privileged for, or bill a payer they are not credentialed with, you are facing crippling recoupments.

Here is how these two processes actually work, where they overlap, and how to manage the timelines.

What is Credentialing? (Proving Who You Are)

Credentialing is the strictly administrative process of verifying that a healthcare provider is who they claim to be. It is a background check on steroids. You are confirming their education, training, licensing, and professional history.

Credentialing happens in two distinct phases: Internal (Primary Source Verification) and External (Payer Enrollment).

Primary Source Verification (PSV)

Before you send anything to Aetna or Medicare, your internal team or a Credentials Verification Organization (CVO) must perform PSV. This means you do not just look at a photocopy of a diploma. You contact the issuing source directly.

Standard PSV requires checking:

• State Medical Licenses: Verified directly through the state medical board portal.
• Education and Training: Contacting the medical school, residency, and fellowship programs (often via the AMA Physician Masterfile or ECFMG for international grads).
• Board Certification: Checking with the ABMS or AOA.
• DEA and State Controlled Substance Registrations: Verified via the NTIS database.
• Malpractice History: Querying the National Practitioner Data Bank (NPDB) to see if the provider has a history of settlements or revoked licenses.

The Payer Enrollment Phase

Once PSV is complete, the revenue cycle team takes over for payer credentialing. This is where you link the provider to your group’s Tax ID so you can actually get paid.

You load all that verified data into CAQH ProView (the centralized database used by most commercial payers) and submit your CMS-855I and CMS-855R forms via PECOS for Medicare.

In 2026, standard credentialing timelines look like this:

• Medicare (MACs): 45 to 60 days if submitted flawlessly via PECOS. Paper applications will drag this out to 90 days.
• Medicaid: Varies wildly by state, but expect 60 to 90 days.
• Commercial Payers (UHC, BCBS, Cigna): 90 to 120 days. Many regional BCBS plans are notoriously slow right now, often taking the full 120 days before issuing a par-effective date.

If you bill a commercial payer before that par-effective date, the claim processes as out-of-network. Best case, the patient gets a massive bill they cannot pay. Worst case (and more likely, given the No Surprises Act enforcement in 2026), you eat the cost entirely.

What is Privileging? (Proving What You Can Do)

If credentialing asks "Are you a real doctor?", privileging asks "Are you competent to perform an arthroscopic rotator cuff repair (CPT 29827) in this specific building?"

Privileging is entirely inward-facing. It is governed by a hospital or ASC’s Medical Staff Bylaws. Just because a physician is a board-certified general surgeon does not mean they automatically get to perform every general surgery procedure at your facility.

Core vs. Specialty Privileges

Facilities grant privileges using a delineation form. This form breaks down procedures into categories.

• Core Privileges: These are the standard procedures any physician in a specific specialty should be able to do. For a family medicine doctor, core privileges might include admitting patients, managing chronic conditions (E/M codes 99221-99223), and performing basic incisions and drainage (CPT 10060).
• Specialty/Add-on Privileges: These require additional proof of training, recent case logs, or specific certifications. If that same family medicine doctor wants to perform diagnostic colonoscopies (CPT 45378), they must request a specialty privilege. The medical staff committee will demand to see a log of the last 50 colonoscopies they performed with complication rates before saying yes.

The FPPE and OPPE Requirements

The Joint Commission mandates two specific evaluations to maintain privileges:

1. Focused Professional Practice Evaluation (FPPE): When a provider is new, or when they request a new privilege (like a new robotic surgery technique), they are placed on an FPPE. Another privileged physician will proctor their first few cases to ensure they are safe and competent.
2. Ongoing Professional Practice Evaluation (OPPE): Every six to nine months, the facility reviews data on the provider. They look at infection rates, return-to-OR rates, length of stay, and blood utilization. If the OPPE data looks bad, the facility can revoke or suspend specific privileges.

Credentialing vs Privileging: The Key Differences

To keep the concepts straight for your onboarding teams, here is a direct breakdown of how the two processes differ.

The Revenue Cycle Impact of Getting It Wrong

Billing managers often view privileging as a purely clinical or administrative headache that doesn't concern the business office. That is a dangerous mindset in 2026. The intersection of credentialing and privileging is where Medicare and commercial auditors hunt for False Claims Act violations.

Billing for Unprivileged Services

Let’s say an OB/GYN is fully credentialed with Medicare and Aetna. The revenue cycle team is happy. However, the physician’s privileges at the ASC explicitly exclude complex urogynecology procedures because they failed to provide adequate case logs during onboarding.

The physician decides to perform a sling operation for stress incontinence (CPT 57288) anyway. The billing team sees the op note, codes it, and drops the claim. Aetna pays it because the doctor is credentialed.

Six months later, an auditor cross-references the ASC's privilege roster against the billed claims. They spot the discrepancy. The facility allowed a provider to perform a surgical procedure they were not authorized to do. This immediately invalidates the medical necessity and compliance of the claim. Aetna will demand the money back, and the state department of health may fine the ASC for violating conditions of participation.

The Telemedicine Proxy Trap

Telehealth exploded, and the rules stabilized by 2026. If your hospital uses remote radiologists to read MRIs (CPT 70551), you run into a unique overlap.

Under CMS guidelines, a hospital can use "credentialing and privileging by proxy." Instead of doing full PSV and privileging for every remote radiologist, your hospital can rely on the credentialing and privileging decisions of the distant-site hospital (the entity providing the radiologist), provided they meet specific Medicare Conditions of Participation.

But if your RCM team doesn't secure the written proxy agreement before billing those remote reads, Medicare will deny the claims. You must have paper proof that the distant site verified the provider's privileges.

The Locum Tenens Confusion

When a physician goes on maternity leave, you might bring in a locum tenens (substitute) physician. Billing rules allow you to bill for the locum's services under the regular physician's NPI using modifier Q6 (for up to 60 continuous days).

Because you are billing under the regular doctor's NPI, you don't need to wait 90 days for payer credentialing for the locum. RCM teams love this. However, the locum still must be fully privileged by the facility before they see a patient. You cannot skip the hospital MEC approval just because you are using a billing modifier.

How to Manage the Dual Timeline in 2026

You cannot afford to have a highly paid surgeon sitting idle for three months, playing sudoku in the breakroom because the paperwork wasn't filed on time. You need a synchronized onboarding workflow.

Follow this strict timeline for new hires:

• Day 1 (Contract Signed - roughly 120 days prior to start date): Immediately trigger the PSV process. Send the provider the CAQH login request and the facility privilege application.
• Day 15: Complete internal PSV. Send the 855I to Medicare via PECOS. Submit commercial payer applications. Simultaneously, route the completed privilege application to the department chair for clinical review.
• Day 45: Follow up with all commercial payers to secure the reference number for the credentialing application. Track this weekly. Meanwhile, the facility Medical Executive Committee (MEC) meets to approve the provider's privileges based on the department chair's recommendation.
• Day 60-90: Medicare typically issues the PTAN. The hospital board officially grants privileges.
• Day 90-120: Commercial payers begin issuing effective dates. The provider is now legally allowed to perform procedures (privileged) and authorized to get paid for them (credentialed).

Keep your billing, credentialing, and clinical scheduling teams in the same communication loop. The OR scheduler needs to know exactly which procedures the provider is privileged for, and the front desk needs a cheat sheet showing exactly which payers the provider is credentialed with on any given date. If you master the distinction between these two processes, you protect your patients, shield your practice from compliance audits, and keep your cash flow uninterrupted.

Frequently asked questions

Can a provider be credentialed but not privileged?

Yes. A provider can be fully credentialed and enrolled with Medicare and commercial payers, but if they have not been granted specific clinical privileges by the hospital or ASC's Medical Executive Committee, they cannot legally treat patients in that facility.

Does CAQH handle both credentialing and privileging?

No. CAQH ProView is a central database used for the primary source verification and payer credentialing side of the process. Privileging requires facility-specific applications, case logs, and peer reviews managed internally by the facility's medical staff office.

How long does credentialing take in 2026?

If submitted cleanly via PECOS, Medicare credentialing typically takes 45 to 60 days. Commercial payers like UHC, Aetna, and BCBS generally take between 90 and 120 days to issue a participating effective date.

What happens if a provider bills for a service they are not privileged to perform?

Billing for an unprivileged service is a major compliance violation. Payers can recoup the payment, auditors may flag the claims under the False Claims Act, and the facility risks losing its accreditation or CMS certification for violating Conditions of Participation.

What is credentialing by proxy?

Credentialing by proxy is a CMS rule often used for telemedicine. It allows a receiving hospital to trust and rely on the credentialing and privileging decisions made by the distant-site hospital providing the remote physician, saving redundant administrative work.