Credential OS // Primary-Source Verification

Expirables That Never Lapse: License, DEA and Board With Primary-Source Verification

Every expirable a provider carries has a real source of truth and a real re-verification clock. Miss one and it does not just fail an audit, it comes back months later as a payer clawback on paid claims. Here is the standing checklist that keeps that from happening.

7Core expirables tracked

36 moNCQA re-verification ceiling

120 dCAQH re-attestation cycle

The short answer

A credentialing file is only as clean as its most stale date. To keep a lapsed license, expired DEA, or dropped board certification from surfacing as a retroactive denial, you verify each expirable from the primary source (the issuing body itself, not a copy the provider hands you) at enrollment, then re-verify on a fixed cadence before it expires, not after.

The rules that govern this are already written: NCQA credentialing standards define what counts as an acceptable primary source and cap re-verification at 36 months, The Joint Commission requires the same at credentialing and privileging, the DEA sets a 3-year registration cycle under 21 CFR 1301.13, and every state board runs its own renewal clock. The checklist below maps each expirable to its source and its cadence so nothing ages out unwatched.

The standing checklist

Every expirable, its primary source, its re-verify clock

Print this. Each card is one line item that lives in Credential OS with an owner, a source, and a countdown. No copies accepted, no self-reported dates trusted.

State Medical / Professional License

Primary sourceState licensing board portal

Re-verifyEach renewal + recredential

GovernsNCQA CR, state statute

No wallet-card copies

DEA Registration

Primary sourceDEA registration validation

Re-verifyEvery 3 yrs (21 CFR 1301.13)

WatchState address on the cert

Practice-address bound

State Controlled Substance Reg (CSR/CDS)

Primary sourceState pharmacy / board

Re-verifyPer state cycle

NoteSeparate from federal DEA

Not all states require it

Board Certification

Primary sourceABMS / AOA / issuing board

Re-verifyAt recredential (≤36 mo)

GovernsNCQA CR, Joint Commission

Time-limited certs expire

Malpractice / Liability Coverage

Primary sourceCarrier certificate (COI)

Re-verifyAt policy expiration

WatchLimits vs. plan minimums

Dated coverage window

CAQH ProView Attestation

Primary sourceCAQH ProView profile

Re-attestEvery 120 days

ImpactStalls payer loads

Silent expirable

Exclusion & Sanction Screening

Primary sourceOIG LEIE + SAM.gov

Re-verifyMonthly

GovernsOIG guidance, state MFCU

Not a one-time check

The cadence, not the calendar

When each clock actually ticks

The lapses that turn into clawbacks are the ones nobody scheduled. A file that verified clean at enrollment is not clean forever. These are the fixed re-verification points every expirable rides on.

DAY 0

Initial primary-source verification

Every item verified at the issuing source before the provider bills a single claim. NCQA credentialing standards define what counts as an acceptable primary source; a copy the provider emails you does not.

EVERY 120 D

CAQH re-attestation

The quietest expirable on the list. A stale CAQH profile does not fail loudly, it just stops payers from loading the provider. Re-attest on the 120-day cycle.

MONTHLY

OIG LEIE and SAM.gov exclusion sweep

Exclusion status can change any month. OIG guidance treats screening as ongoing, so re-check the full roster on a monthly cadence, not just at hire.

PER CYCLE

License, DEA and CSR renewals

DEA runs a 3-year clock under 21 CFR 1301.13; state license and controlled-substance registrations run their own board cycles. Re-verify at the source before each expiration, never after the renewal date passes.

≤ 36 MONTHS

Full recredentialing

NCQA caps the recredentialing interval at 36 months and The Joint Commission requires re-verification at credentialing and privileging. License, board certification, DEA and malpractice all get primary-source verified again here.

Why the clock matters

How a missed date becomes a clawback

A lapse is invisible on the day it happens. The cost shows up later, after the payer has already paid, when a retro audit walks the dates back.

STEP 01License lapsesRenewal date passes unwatched

STEP 02Claims keep billingProvider still sees patients

STEP 03Payer paysNothing flags at adjudication

STEP 04Retro auditDates walked back months later

STEP 05ClawbackPaid dollars recouped, not just denied

The rules behind the checklist

Real standards, cited by name

None of this is invented. Each expirable maps to a published requirement you can point an auditor to.

NCQA // CREDENTIALING

NCQA Credentialing Standards (CR)

Define acceptable primary sources for license, DEA, board certification and education, and cap the recredentialing interval at 36 months.

TJC // MS.06.01.03 & .05

The Joint Commission

Require primary-source verification of licensure and credentials at credentialing and again at privileging, on a defined cycle.

DEA // 21 CFR 1301.13

Federal DEA Registration

Sets the 3-year registration term and practice-location binding for controlled-substance prescribing.

STATE // BOARD STATUTE

State Licensure & CSR

Each state board runs its own license and controlled-substance registration renewal cycle, verified at the board portal.

CAQH // PROVIEW

CAQH Re-attestation

Requires providers to re-attest their profile every 120 days for payer data to stay current.

CMS // 42 CFR 424.515

Medicare Revalidation

Enrolled providers revalidate on a set cycle (generally every 5 years) to keep billing privileges active.

Turn the checklist into a system that watches the dates for you

Credential OS holds every expirable with its primary source, its owner, and a countdown that fires before the clock runs out, not after. That is the difference between a clean audit and a clawback you find out about in month four. Let us show you your own roster on it.

Book a Credential OS walkthrough

Sources referenced: NCQA Credentialing Standards, The Joint Commission MS.06.01.03 / MS.06.01.05, DEA 21 CFR 1301.13, state licensing and controlled-substance rules, CAQH ProView, OIG LEIE, CMS 42 CFR 424.515.