Continuous vs Three-Year: The Cycle NCQA Now Rewards
The 36-month recredentialing clock did not go away. What changed is everything that happens in the 35 months between cycles.
The short answer: NCQA still requires you to formally recredential each practitioner at least every 36 months. But the standards now lean hard on ongoing monitoring between cycles, so a clean file at recredentialing is no longer proof of a clean file the other 1,079 days. Credential OS runs both clocks at once: the triennial cycle for the record, and continuous primary source verification for the reality.
The two clocks
One cadence protects the file. The other protects the patient.
Most credentialing programs treat recredentialing as a calendar event and go quiet until it fires. NCQA's Credentialing and Recredentialing (CR) standards no longer accept the quiet stretch. Here is the contrast, side by side.
- Full file rebuilt once every three years
- License, DEA, board status verified only at the cycle
- A mid-cycle sanction can sit undetected for up to 35 months
- Exclusion or malpractice event surfaces at renewal, not at occurrence
- Auditable on paper, exposed in practice
- 36-month recredentialing still runs, on schedule
- Ongoing monitoring of sanctions, complaints and adverse events between cycles
- Exclusion lists and license status re-checked on a set cadence, not annually
- An event triggers review the day it posts, not at renewal
- The file and the field say the same thing every day
The lifecycle, on a timeline
What a Credential OS file actually does across a three-year term.
Read top to bottom. The gold node is the only date the legacy model ever touched. Everything else is the continuous layer NCQA's ongoing-monitoring expectation now asks you to run.
The file is built from primary source
Education, board certification, work history, license, DEA and malpractice history verified against the primary source, not the application. CAQH ProView pulls the attested profile; Credential OS reconciles every field to the issuing authority.
NCQA CR · PSV at onboardingSanctions and exclusions checked on cadence
OIG LEIE and SAM.gov exclusion lists, state Medicaid sanction lists and license boards re-queried on a fixed monthly rhythm. A newly excluded provider is flagged the cycle it posts, protecting you from billing under an excluded NPI.
Ongoing monitoring layerAdverse events trigger review on arrival
Complaints, malpractice actions, member grievances and quality events are captured against the practitioner record as they occur. The review is triggered by the event, not held until the next renewal date.
Between-cycle surveillanceTime-bound credentials never lapse silently
License, DEA and board expirations are tracked to their own dates and re-verified ahead of expiry through primary source, so a lapsed credential is caught before it affects claims, not after a denial.
Expiry-aware PSVThe triennial cycle fires, with nothing to chase
NCQA requires recredentialing at least every 36 months. Because the continuous layer kept the file current, recredentialing becomes a formal re-attestation and sign-off, not a three-year archaeology dig. The board decision rests on a file that was never stale.
NCQA CR · 36-month maximumNext term begins clean
The new three-year term starts on a verified baseline, and the continuous monitoring simply carries on. No cold start, no re-onboarding scramble, no gap between what the record says and what is true.
Continuity preservedWhat ongoing PSV changes for the file
Continuous verification is not "check more often." It is a different source cadence per credential.
Primary source verification means every credential is confirmed with the authority that issued it. Continuous monitoring means each of those sources has its own re-query rhythm, tuned to how fast that credential can change.
License status
Verified against the issuing state medical or specialty board, and re-queried between cycles rather than left to renewal.
ContinuousExclusions
OIG LEIE and SAM.gov swept on a monthly cadence so an excluded provider never bills unnoticed.
MonthlyBoard certification
Certification and expiration confirmed at the certifying board, tracked to its own expiry date, re-verified before it lapses.
Expiry-drivenAttested profile
CAQH ProView supplies the practitioner's self-reported profile; Credential OS reconciles each field to primary source, never trusting attestation alone.
On attest + changeThe distinction that matters at audit
CAQH ProView is where a provider attests. Primary source verification is where you prove it. NCQA's CR standards accept the attested profile as an input, not as verification. Continuous monitoring is what closes the gap between the two on every day of the term, not just on day 1,080.
References describe NCQA Credentialing and Recredentialing (CR) standards, including the 36-month recredentialing maximum and ongoing monitoring expectations. Verify current CR standard language against your program's edition of the NCQA Standards and Guidelines before implementation.
Guidelines cited on this page
- NCQA Credentialing and Recredentialing (CR) standards, including recredentialing at least every 36 months and ongoing monitoring of sanctions, complaints and adverse events between cycles.
- CAQH ProView as the practitioner-attested credentialing data source reconciled to primary source.
- Primary source verification (PSV) of license, board certification, education, work history, DEA and malpractice history against the issuing authority.
- OIG List of Excluded Individuals/Entities (LEIE) and SAM.gov exclusion databases for ongoing exclusion monitoring.
Run both clocks without hiring for the gap.
Credential OS keeps the 36-month cycle on schedule and the continuous monitoring layer running underneath it, so your files are audit-ready on any given day, not just at renewal. If your team is rebuilding credentials from scratch every three years, that is the work we take off the calendar.
See Credential OS on your panel →Related reading
Never miss the date that quietly stops your billing.
How Credential OS tracks every provider's PECOS revalidation due date and effective dates so a lapsed Medicare
Read →Field noteCutting Payer Enrollment Lag With Parallel PECOS and CAQH Tracking
Cut payer enrollment credentialing turnaround by running PECOS, CAQH ProView, and commercial payer tracks in p
Read →InsightThe Medicare Effective-Date Trap:a PECOS enrollment checklist
A field-tested PECOS and CMS-855 enrollment checklist built around the Medicare effective date and the 30-day
Read →