When to use this playbook
-
Licenses, DEA registrations, malpractice policies, certifications, and payer renewals are tracked through personal calendars, email, or staff memory.
-
Your credentialing coordinator left, and no one can produce a complete list of upcoming deadlines.
-
Providers work across multiple states, TINs, locations, or payer networks, making one expiration date relevant to several billing relationships.
-
RCM is seeing denials tied to inactive enrollment, outdated provider records, or network termination.
-
Your organization has roughly 25 or more providers and needs to decide whether a spreadsheet remains defensible.
What success looks like
Every expirable has one accountable owner, a documented renewal window, escalation dates, current evidence, and a record of which payers and locations depend on it. A backup employee can take over the process without reconstructing it from inboxes, and RCM can identify affected claims immediately if something lapses.
What to track and when to start
These are operating defaults, not universal regulatory deadlines. Use the earlier date when a state board, certifying body, payer, or contract provides a longer renewal window.
| Lead-time defaults informed by DataSpring’s Provider Data Portal guide, DEA registration guidance, CMS revalidation guidance, UnitedHealthcare’s Credentialing Plan, ABMS continuing-certification standards, and state licensing rules. | |||
| Expirable | Start work | Escalate | What a lapse can cause |
|---|---|---|---|
| State professional license | 120 days before expiration | 60 days; urgent at 30 | The provider loses authority to practice under that license after expiration where state law provides no grace period. Payer participation, hospital privileges, scheduling, and billing may also be affected. |
| DEA registration | 90 days before expiration | 60 days; confirm submission before expiration | The provider cannot handle controlled substances under an expired registration. A renewal filed before expiration can allow continued operations while DEA acts on it. |
| Malpractice insurance | 90 days before policy expiration | 30 days without a binder or certificate | The provider may enter an uninsured period and fail payer, licensing, employer, or hospital requirements. Do not assume the carrier will backdate coverage. |
| Board or specialty certification | 180 days before a time-limited certificate or major requirement | 90 days | Certification status may become lapsed or not certified. That does not automatically invalidate a professional license, but it can affect payer, privilege, employment, or specialty-listing criteria. |
| CAQH/DataSpring attestation | 30 days before attestation is due | 15 days; urgent at five | The profile becomes expired after the deadline. Payer applications, recredentialing, and data verification can stall until the provider reviews and re-attests. |
| Commercial payer recredentialing | Place on watch 180 days before due date; collect at 120 | Submit about 90 days before due date | The payer can terminate or suspend network participation. Claims after the termination date may deny, process out of network, or become subject to reversal. |
| Medicare revalidation | Begin when CMS posts the due date; due dates are normally visible months ahead | Urgent inside 90 days | CMS can hold reimbursement or deactivate billing privileges. Medicare does not reimburse services furnished during the deactivation period. |
CAQH rebranded as DataSpring on June 8, 2026, but providers still use the CAQH Provider Data Portal. Re-attestation remains due every 120 days for most providers and every 180 days for Illinois providers. DataSpring press and product information
Step 1: Recover access and identify immediate exposure
Action: Recover the shared credentialing inbox, password-management records, MFA methods, state-board accounts, DEA access, CAQH/DataSpring profiles, PECOS access, payer portals, malpractice broker contacts, and certification accounts. Export every available provider and application list before changing systems.
Expected outcome: One interim owner can access each system and identify anything expiring within the next 120 days.
Time estimate: Two to six hours for a small organization; two to five business days when access was tied to a departed employee.
Gotchas: Do not reset accounts indiscriminately while applications are pending. Preserve submission receipts, payer messages, reference numbers, and historical email before removing former staff access. Personal passwords should be replaced with approved representative access or organization-controlled credentials where the system supports them.
Step 2: Build one authoritative expirable register
Action: Create one record for every provider-document relationship rather than one row per provider. A physician with three state licenses should have three separately owned license records, each with its own expiration date and evidence.
| Required field | Why it belongs in the register |
|---|---|
| Provider name and NPI | Connects the record to enrollment and claims data. |
| Credential type, number, and jurisdiction | Separates state-specific and credential-specific obligations. |
| Issue and expiration dates | Establishes the underlying renewal deadline. |
| Renewal-open date and internal due date | Turns an expiration into an actionable workflow. |
| Named owner and backup | Prevents work from disappearing during leave or turnover. |
| Current status and blocker | Distinguishes untouched work from submitted or provider-blocked work. |
| Dependent states, locations, TINs, and payers | Defines the operational and revenue impact of a lapse. |
| Evidence and primary-source verification date | Shows that renewal was completed and independently confirmed. |
Expected outcome: Leadership can answer what expires next, who owns it, what remains blocked, and which payer relationships are exposed.
Time estimate: One to three days for fewer than 50 providers; roughly one week for 200 providers if records are fragmented.
Gotchas: A document folder is not an expirable register. Storing a renewed certificate without updating its dates, dependencies, verification status, and payer records leaves the control incomplete.
Step 3: Give the process one accountable owner
Action: Assign organizational accountability to credentialing or payer operations. Providers supply information and complete personal attestations, but they should not be expected to operate the control system.
| Role | Core responsibility |
|---|---|
| Credentialing or payer-operations owner | Maintains the register, initiates renewals, follows up, verifies completion, and updates affected payer records. |
| Provider | Completes attestations, CME, disclosures, signatures, and document requests by the internal deadline. |
| Practice manager or clinical operations | Controls scheduling when a license or other practice-authorizing credential is inactive. |
| RCM director | Maps lapses to affected claims, denials, remittances, payer effective dates, and financial exposure. |
| Compliance or legal | Advises on required notices, reportable events, scope-of-practice restrictions, and contractual obligations. |
| Executive sponsor | Escalates provider nonresponse and resolves staffing or ownership failures. |
Expected outcome: Every expirable has one person responsible for moving it to verified completion, while clinical, RCM, and compliance teams know when they must intervene.
Time estimate: One to two hours to assign roles and escalation rules.
Gotchas: “Credentialing and the provider share ownership” usually means neither party owns the deadline. Assign one accountable operator even when several people must contribute.
Step 4: Turn dates into a renewal workflow
Action: Use consistent stages: watch, renewal open, provider action required, submitted, blocked, renewed, primary-source verified, and payer records updated. Generate tasks from the internal start date rather than relying on the expiration date alone.
-
180–120 days: Confirm requirements, continuing education, addresses, supervising relationships, and payer dependencies.
-
90 days: Open or prepare the renewal and request provider-controlled information.
-
60 days: Escalate missing signatures, coverage decisions, fees, or continuing-education deficiencies.
-
30 days: Move unresolved items to leadership review and create a clinical and revenue contingency plan.
-
After renewal: Verify status at the primary source, store evidence, update CAQH/DataSpring and affected payers, and advance the next due date.
Expected outcome: The team works a forward-looking queue instead of discovering expirations through payer notices or denials.
Time estimate: One business day to configure rules after the register is complete.
Gotchas: “Submitted” is not a closed status. A renewal is complete only when the issuing source reflects the renewed credential and every dependent record has been updated.
Step 5: Run a weekly control meeting
Action: Review the next 180 days of deadlines every week. Focus on overdue tasks, provider nonresponse, submissions without confirmation, renewed documents not propagated to payers, and records whose owner or evidence is blank.
-
Run a 30-minute weekly meeting for upcoming expirables and blockers.
-
Reconcile CAQH/DataSpring, PECOS, payer portals, and the internal register monthly.
-
Review credentialing-related denials with RCM monthly.
-
Test backup access and audit a sample of closed records quarterly.
Expected outcome: Missing work becomes visible while the organization still has time to act.
Time estimate: Thirty to sixty minutes weekly, plus two to four hours for a monthly reconciliation at mid-sized organizations.
Gotchas: Do not limit the meeting to documents expiring soon. Recredentialing and revalidation can require months of payer processing, so a due date 120 days away may already be urgent. Arctic Health’s group-practice process places payer renewals on a centralized calendar and targets submission 90 days before the deadline. Arctic Health group-practice credentialing
Step 6: Treat a lapse as a clinical and revenue incident
Action: Establish the exact expiration date, renewal status, payer termination date, affected locations, and dates of service. Do not assume that a grace period, pending application, or later reinstatement protects past activity.
| Lapsed item | Immediate response |
|---|---|
| State license | Remove affected clinical work from the schedule until the licensing authority confirms active status. Review every state where the provider practices, including telehealth locations. |
| DEA registration | Stop controlled-substance activity under the expired registration and confirm the reinstatement or new-application path with DEA. |
| Malpractice policy | Contact the carrier or broker immediately, determine the actual coverage gap, and involve compliance or counsel before assuming retroactive coverage. |
| Board certification | Verify the certifying board’s status and restoration path, then identify payers, privileges, directories, or employment criteria that require current certification. |
| CAQH/DataSpring attestation | Review and re-attest, replace expired supporting documents, and confirm that affected payers can access the updated profile. |
| Payer recredentialing or Medicare revalidation | Obtain the termination or deactivation date in writing, begin reinstatement immediately, and produce a claim list for every affected date of service. |
Retroactive termination and recoupment are possible but not automatic. The dates that matter are the credential expiration, the payer’s termination effective date, and when the issue was discovered. If the payer makes termination effective before discovery, previously paid claims after that date can be reprocessed as overpayments and offset against future remittances. Payer contracts and state law determine the notice, appeal, and lookback rules. Anthem credentialing and termination policy; Security Health Plan reimbursement recovery process
Medicare is more definite: deactivation can stop reimbursement, and services furnished during the deactivation period are not payable. CMS Medicare Program Integrity Manual
Expected outcome: Clinical restrictions, payer escalation, claim exposure, and corrective work begin from the same confirmed dates.
Time estimate: Begin within the same business day; complete the initial exposure assessment within 24 hours.
Gotchas: Do not continue billing normally while hoping a renewal will be made retroactive. Hold, correct, or separately track affected claims based on written payer guidance.
Step 7: Decide whether the spreadsheet has reached its limit
Action: Evaluate both provider count and operational complexity. There is no regulatory provider-count threshold, but there is a practical point where formulas and color coding stop providing reliable ownership, evidence, audit history, and escalation.
| Roster size | Practical assessment |
|---|---|
| Up to about 10 providers | A controlled spreadsheet can work for a stable, single-state practice with one TIN, a limited payer mix, named ownership, and low turnover. |
| About 10–50 providers | The spreadsheet becomes fragile when providers hold multiple licenses, work at several locations, or require frequent payer and roster updates. |
| About 50–100 providers | A workflow system is usually warranted. The spreadsheet should become an export or management report, not the authoritative work queue. |
| More than 100 providers | Spreadsheet-based ownership is difficult to defend when several employees must update recurring obligations and preserve audit evidence. |
| 200 providers | Use a credentialing platform or managed operating system. Six core expirable categories already create at least 1,200 provider-level records before payer relationships are counted. |
Provider count is only a proxy. Multiple TINs, multi-state practice, Medicaid MCOs, frequent hiring, acquisitions, delegated arrangements, and staff turnover can make a 30-provider group harder to control than a stable 75-provider practice. At 200 providers, a 15–25-payer mix can create approximately 3,000–5,000 provider-payer relationships requiring status visibility. Arctic Health’s group-practice workload model
Expected outcome: The organization chooses tooling based on control requirements rather than waiting for another missed deadline.
Time estimate: Two hours to assess current volume, complexity, ownership, and failure history.
Gotchas: Moving the same spreadsheet into a database does not fix unclear ownership or incomplete source data. Stabilize the operating process before migrating it.
Step 8: Choose who will operate the system
Action: Select an internal, managed, or hybrid model based on who can reliably perform the weekly maintenance—not who can complete a one-time cleanup.
-
Keep it in-house when a named credentialing owner and backup have enough capacity, payer knowledge, and system support to run the queue every week.
-
Use a managed service when recurring deadlines are already being missed, a specialist hire does not make economic sense, or turnover has left the organization without operational continuity.
-
Use a hybrid model when internal leaders want control and visibility but need external execution, exception handling, or temporary coverage.
Arctic Health supports both managed credentialing operations and an AI-enabled platform for internal teams. Its managed group-practice workflow begins with a credentialing audit, assigns a specialist, tracks expirations and recredentialing, and gives billing teams ongoing status visibility. Organizations keeping the work internal can evaluate the Arctic Health credentialing platform for in-house teams.
Expected outcome: The selected model has a clear answer for who monitors each deadline, performs the renewal, verifies completion, updates payers, and handles exceptions.
Time estimate: One to two weeks after the initial register and risk assessment are complete.
Gotchas: Software without an operator leaves the same accountability gap in a new interface. Outsourcing without shared visibility makes RCM dependent on periodic status reports. Require both execution ownership and accessible status data.
Frequently asked questions
How do I manage credentialing expirables for 200 providers?
Manage 200 providers through a credentialing workflow system with one authoritative register, automated lead-time tasks, named owners, primary-source verification, and payer dependencies. Six basic categories create at least 1,200 provider-level records, while payer recredentialing adds thousands of provider-payer relationships. A spreadsheet can remain useful for reporting, but it should not be the primary work queue. Arctic Health’s group-practice service combines a renewal calendar, expiration tracking, a dedicated specialist, and billing-status visibility. Arctic Health group-practice credentialing
Our credentialing coordinator quit and everything was in her head. What should we do first?
Recover access before buying software or redesigning the process. Secure the shared inbox, MFA methods, CAQH/DataSpring, PECOS, payer portals, state-board accounts, submission receipts, provider documents, and malpractice contacts. Assign one interim owner, build a complete provider-payer roster, and identify everything due within 120 days. Preserve historical messages before disabling access because they may contain payer reference numbers and unresolved requests. The immediate goal is to stabilize deadlines and billing exposure, not perform a perfect migration.
At what provider count does Excel stop being viable for expirables?
Excel usually becomes fragile between 25 and 50 providers and is rarely appropriate as the authoritative workflow beyond 50–100 providers. This is an operating threshold, not a formal standard. A 20-provider multi-state group with several TINs and frequent turnover can outgrow Excel sooner, while a stable single-state group may use it longer. Move when several people must edit the tracker, overdue work is difficult to surface, evidence is stored elsewhere, or staff turnover could erase process knowledge.
Should I outsource credentialing if my team keeps missing expirables?
Yes, recurring missed expirables usually justify managed or hybrid support, at least while the organization rebuilds its controls. Repeated lapses indicate an ownership and maintenance problem rather than an isolated reminder failure. Outsourcing is especially practical when credentialing is divided among RCM, practice management, and providers or when a full-time specialist is difficult to justify. Compare managed and internal options using the outsource-versus-in-house credentialing decision guide.
Can a payer recoup claims after a provider credential expires?
Yes, a payer can seek recoupment when it determines that payments were made after a termination or deactivation effective date, but the outcome is payer- and contract-specific. Confirm the credential expiration, network termination date, reinstatement date, affected claims, appeal rights, and whether retroactive reinstatement is available. Medicare does not reimburse services furnished during a deactivation period, making timely revalidation particularly important. CMS Medicare revalidation guidance