Credentialing Operations · 2026 Standards

CAQH and NCQA, side by side. Both cycles satisfied at once.

Here is the short answer. NCQA and CAQH are not two versions of the same rule, they are two clocks running at different speeds. NCQA re-credentials every 36 months. CAQH wants a fresh attestation every 120 days. Credential OS treats one provider record as the source of truth and feeds both clocks from it, so you stop re-typing the same roster into every payer form.

120CAQH days

36NCQA months

The two-clock problem

Same provider. Same data. Two very different deadlines.

Most lapses do not come from bad data. They come from watching the wrong clock. A provider can be perfectly re-credentialed with a health plan and still fall out of network because a CAQH attestation quietly expired at day 121.

NCQA re-credentialing cycle

36 months

A full re-verification and committee review, timed from the last approval date. The work should start 90 to 120 days early.

turns
~9×

CAQH re-attestation cycle

120 days

A confirmation that the profile is still accurate. It comes due roughly nine times inside a single NCQA cycle.

What each standard actually asks for

Peel the two stacks apart, then reconcile them.

Hover a stack to fan the layers. NCQA governs the depth of verification. CAQH governs the freshness of the self-reported profile that payers pull from. Different jobs, one record underneath.

NCQA

Re-credentialing requires

depth · proof · committee sign-off

Primary source verification

120 / 90 day window

License, DEA, board status and sanctions verified at the source. The July 2025 update tightened the PSV window to 120 days for Credentialing Accreditation and 90 days for Credentialing Certification.

NCQA 2026 Credentialing & Recredentialing (CR) standards

Ongoing monitoring

monthly

Monthly license-expiration tracking and monthly exclusion checks against OIG, SAM.gov and the applicable state boards, each logged with a timestamp, escalated to peer review when something hits.

NCQA ongoing-monitoring requirements

Recredentialing every 36 months

from approval date

Exactly 36 months from the last committee approval, not approximately. Miss it and the practitioner is no longer credentialed regardless of CAQH status.

NCQA CR recredentialing cycle

Credentialing committee record

auditable

A documented decision trail an auditor can follow. NCQA reviewers want proper timestamped logs, not spreadsheets rebuilt after the fact.

NCQA file-review methodology

CAQH

Attestation refresh requires

freshness · completeness · access

Re-attest every 120 days

30 / 14 / 3 reminders

Log in, confirm the profile is current, attest. The portal emails reminders at 30, 14 and 3 days out. If nothing changed it is a five-minute confirmation, but the clock does not forgive a miss.

CAQH Provider Data Portal attestation cycle

Complete, payer-ready profile

self-reported

Practice locations, hospital affiliations, malpractice coverage and documents kept current so every authorized health plan pulls clean data instead of chasing you for a form.

CAQH profile completeness

Payer authorization & access

roster-driven

Each plan must be authorized to view the profile. This is the layer that silently breaks when a provider joins a new panel and no one flips access on.

CAQH data-access authorization

Now the CAQH Provider Data Portal

2026 rebrand

Formerly CAQH ProView, moved under the DataSpring brand in 2026. Same URL, same logins, same 120-day rule. The name changed, the cadence did not.

CAQH 2026 platform rebrand

How Credential OS reconciles both

One record in the middle, feeding both clocks.

The teams that stay compliant stopped maintaining a CAQH list and an NCQA list and a spreadsheet per payer. They maintain one provider record and let the system fan it out.

NCQA obligations in

36-month recredential dates
PSV window countdown (120 / 90 day)
Monthly OIG / SAM.gov / board sweep
Committee-ready file

Credential OS

One provider record. Every date, document and status stored once, versioned, and mapped to the standard that needs it.

CAQH obligations in

120-day attestation countdown
Profile completeness checks
Per-payer access authorization
Document expiry watch

Change a license number once and both clocks update. The attestation refreshes, the NCQA file re-verifies, and no one re-keys the same value into a ninth payer portal.

The cadence, drawn to scale

Nine attestation windows inside one recredential.

NCQA · one 36-month cyclestart work at day ~1005

One deep re-verification with a committee decision at the end. The tick marks the 90-to-120-day head start NCQA expects.

CAQH · same 36 months~9 re-attestations

Each band is a 120-day window. Every boundary is an attestation that, if missed, can drop the provider from payer directories long before the NCQA date arrives.

Side by side

What NCQA requires vs what CAQH refreshes.

Dimension	NCQA re-credentialing	CAQH attestation
Core job	Verify credentials at the source and decide	Keep the self-reported profile current
Cadence	Every 36 months from approval	Every 120 days
Data origin	Primary sources, verified	Provider self-report, attested
Verification window	120 days (Accreditation) / 90 days (Certification)	Confirmation only, no PSV
Ongoing checks	Monthly license & OIG / SAM.gov / board sweeps	Reminders at 30 / 14 / 3 days
Failure mode	Practitioner no longer credentialed	Profile goes stale, payers lose access
Credential OS role	Countdown, PSV timing, monthly sweeps and an audit-ready file, generated from one record	Attestation reminders and completeness driven from that same record, no re-keying

Where it gets political

Delegated credentialing and the turnaround clock.

Delegated credentialing oversight

When a payer delegates credentialing to your organization or a CVO, that arrangement gets audited. NCQA expects the delegate's certification to actually cover the elements being delegated.

Confirm the CVO's NCQA certification covers the delegated elements
Request the current excerpt from their NCQA Report Card, do not assume
Keep pre-delegation and annual audit files reconstructable on demand
Map every delegated element back to one record so audits are a report, not a fire drill

Turnaround-time expectations

Payers and several states hold credentialing to turnaround windows, and the enrollment queue behind them is where revenue quietly stalls. The lever is not working harder, it is never restarting from a blank form.

Start recredentialing 90 to 120 days early, as NCQA intends
Keep CAQH attested so a payer pull never bounces mid-enrollment
Track each application's clock so nothing sits unowned
Feed payer packets from the verified record to cut rework loops

Stop chasing each payer's form. Maintain one record instead.

Credential OS is the credentialing platform behind ASP-RCM Solutions. It holds one verified provider record, runs the NCQA 36-month clock and the CAQH 120-day clock from the same data, and turns audits into a report you can pull rather than a week you dread. That is fewer lapses, faster enrollment, and revenue that is not waiting on a stale attestation.

Book a Credential OS walkthrough → Talk to our credentialing team

ASP-RCM Solutions · Credentialing & Enrollment · Frisco, TX

Guidelines referenced: NCQA 2026 Health Plan Credentialing and Recredentialing (CR) standards, including the July 2025 primary-source-verification window update (120 days Credentialing Accreditation, 90 days Credentialing Certification) and monthly ongoing-monitoring against OIG, SAM.gov and state licensing boards. CAQH Provider Data Portal (formerly CAQH ProView, rebranded under DataSpring in 2026), 120-day re-attestation cycle with reminders at 30, 14 and 3 days. NCQA delegation oversight and NCQA Report Card verification for delegated CVOs. This piece is operational guidance, not legal or accreditation advice. Confirm current requirements against the published NCQA standards and CAQH portal for your programs.