Primary Source Verification in Credentialing: What NCQA Requires and Where to Check

Updated November 5, 2026, based on NCQA, CAQH, the HHS Office of Inspector General and the National Practitioner Data Bank as of that date.

Health plans and credentialing verification organizations (CVOs) that hold NCQA accreditation or certification must verify each clinician's credentials at the source. NCQA describes this as verification "through a primary source, through a recognized source or through a contracted agent of the primary source." The items are license, DEA or CDS certificate, education and training, board certification, work history, malpractice history, and licensing board and Medicare and Medicaid sanctions and exclusions.

Verifications have time limits. Under NCQA Credentialing Accreditation, the limits run 120 or 180 days depending on the item, and CVO certification limits are shorter.

These standards bind the plan or CVO, not your group. They still explain why files come back. An expired document, a lapsed CAQH attestation or a verification that aged past its limit can send the file back. This guide covers what gets verified, the time limits, where each check happens, and what slows a file down.

What primary source verification means under NCQA

NCQA's guide to its credentialing programs lists the work credentialing organizations do: initial verification at the source, a credentialing committee that reviews files, and "Monthly monitoring practitioner sanctions, license expiration, complaints and quality issues between recredentialing cycles."

The guide says its 11 credentialing evaluation products are "required for NCQA-Accredited health plans, behavioral healthcare organizations (BHO) and for organizations with NCQA Accreditation in Credentialing." Plans can delegate the work to a CVO or another entity. NCQA still "holds the delegating organization responsible for delegated NCQA activities." For your group, that means each plan or its CVO runs these checks on your clinicians, whoever does the work.

The items that get verified

NCQA's credentialing certification program lists these evaluation products:

1. License to practice
2. DEA or CDS certification
3. Education and training
4. Board certification status
5. Work history
6. Malpractice claims history
7. State licensing board sanctions
8. Medicare and Medicaid sanctions
9. Practitioner application processing
10. Application and attestation content
11. Ongoing monitoring of sanctions

The clinician's application and signed attestation are on the list too. That's where your CAQH profile comes in.

Verification time limits

NCQA's September 2025 guide says its time frames let organizations "work with more current data and get practitioners enrolled into networks faster." It lists these limits, first for Credentialing Accreditation and then for Credentialing Certification (CVOs):

• License to practice: 180 days; 90 days
• Board certification: 120 days; 90 days
• Work history: 180 days; 120 days
• Malpractice history: 120 days; 90 days
• State licensing sanctions: 120 days; 90 days
• Medicare and Medicaid sanctions: 120 days; 90 days
• Credentialing application attestation: 180 days; 120 days
• Medicare and Medicaid exclusions: 120 days; 90 days

NCQA's corrections to the 2025 health plan standards show these limits change by date. For one credentialing factor, they say: "The 180-calendar-day verification time limit applies to files processed by the organization or its delegate(s) on or after July 1, 2025." Files processed earlier were scored against 365 days. NCQA publishes corrections to its standards and updates them by year, so a plan's credentialing staff can confirm which limit it applies to your file.

Where sanctions and exclusions are checked

The same NCQA corrections name the sources. For Medicaid sanctions, the organization uses the state Medicaid agency plus one of the AMA Physician Masterfile, FSMB, NPDB or SAM.gov. The Medicare sanction sources listed are the AMA Physician Masterfile, FSMB, NPDB and SAM.gov.

Exclusions have their own sources. Medicaid exclusions come from both the state Medicaid agency and the "List of Excluded Individuals and Entities maintained by OIG." Medicare exclusions come from either the Medicare Exclusion Database or that OIG list. NCQA also clarified that "The organization verifies sanction and exclusion information (from factors 1-3) for all product lines," not only Medicare and Medicaid.

The OIG exclusions page offers an online search and a CSV download, and monthly supplements for organizations that keep their own copy. OIG tells state Medicaid agencies that the list "must be checked on a monthly basis, and in connection with any new enrollments."

NPDB queries: required for hospitals, permitted for plans

The National Practitioner Data Bank collects medical malpractice payments and certain adverse action reports. Its hospital guidance says "Hospitals are the only health care entities mandated by federal law to query the NPDB." Hospitals query at appointment or privileging and every two years after that.

Health plans are in a different position. The NPDB's page for health plans says "Health Plans may query under certain conditions." So a plan or its CVO may run an NPDB query on your clinician, and NPDB is one of the sources NCQA accepts for sanctions.

CAQH ProView attestation and documents

When a plan uses CAQH ProView for the application, the profile runs on its own cycle. The CAQH ProView quick reference tells providers: "Every 120 days (180 days for providers practicing in Illinois), you will receive a notification from CAQH ProView to re-attest that all of the information in your profile is still correct." The "View Documents" screen shows uploaded documents, "as well as any missing or expired documents."

A profile becomes usable only after attestation and document review. CAQH says the information then "will be available to the organizations you authorized," and that providers "will need to check with each individual organization to determine your credentialing status."

The profile supplies the application and attestation. The license, sanction and exclusion checks above still happen at their own sources. Our CAQH automation guide covers keeping profiles, documents and attestations current.

What slows a credentialing file down

A file can stall for any of these reasons:

• Expired or missing documents. CAQH flags them on the documents screen, but someone has to look.
• A lapsed attestation. CAQH makes the profile available to plans only after attestation, and the 120-day cycle keeps running while a file is open.
• Verifications that age out. A file that sits can pass the 120 or 180 day limit for an item, and that item may need to be verified again.
• Form errors found late. How long a payer takes to catch a mistake and send the application back varies by payer.

The fix for most of these is to check a clinician's materials as soon as they arrive. Compare them against the list above, then ask the clinician for the specific missing item instead of rejecting the submission. Whether a certificate of insurance or other supporting document is required varies by plan, so keep each plan's checklist. Credentialing is followed by enrollment with each payer, covered in our guide to provider enrollment automation.

Frequently asked questions

Does a CAQH profile count as primary source verification?

The profile is the clinician's application and attestation, which NCQA also requires. Plans and CVOs still verify license, sanctions, exclusions and the other items through primary or recognized sources.

How old can a verification be?

NCQA's September 2025 guide lists 120 or 180 days under Credentialing Accreditation, depending on the item, and 90 or 120 days under CVO certification. Confirm with the plan which standard and year it applies.

Do we have to query the NPDB ourselves?

Federal law requires hospitals to query. Health plans may query under certain conditions. Check the NPDB's guidance for your organization type before assuming either.

How often must exclusions be checked?

NCQA describes monthly monitoring of sanctions between recredentialing cycles, and OIG tells state Medicaid agencies to check its list monthly and at each new enrollment. Plans may set their own schedule on top of that.

Does a certificate of insurance need primary source verification?

Malpractice insurance coverage isn't one of the 11 evaluation products NCQA lists. Whether a plan requires a current certificate, and how it checks it, varies by plan.

Keeping clinician files current across CAQH and payer portals?

Champ automates portal work like CAQH re-attestations and profile checks. We set it up and run it, so your team sees only the finished results. If a growing roster means more re-attestations and document follow-ups, learn more here.

This post is general information, not legal, compliance or billing advice. Rules vary by health plan, CVO and state and change often, so confirm with the plan's credentialing staff or NCQA before acting. Champ is not affiliated with or endorsed by NCQA, CAQH, the HHS Office of Inspector General, the National Practitioner Data Bank or any health plan.