How Long Does Provider Credentialing Take? Plan It as the Critical Path

The honest answer: there is no national average

How long does provider credentialing take? Nobody can give you a trustworthy national number. We looked for one from an authoritative source (the industry's credentialing data utility, the medical group associations, federal auditors) and did not find it, and the round figures in vendor blogs are not sourced to anything we could check. What does exist is a set of clocks. Several state laws give insurers 60 days from a complete application. NCQA's verification time limits run 120 or 180 days depending on the element. Recredentialing comes at least every 36 months. Medicaid allows up to 120 days of network participation pending state enrollment. And CAQH profiles need re-attestation every 120 days. Plan your build around those clocks, not around an average.

Here is our opinion, and it comes from watching builds slip. Credentialing sets your network's go-live date. Most build plans draw it as a box after contracting, and that is why they are late.

Credentialing is the critical path, not a step

A network build has a satisfying moment when the contract comes back signed. Recruiting marks the provider won, the adequacy map turns a county green, and the weekly report shows progress. Then nothing happens for months. In most plans a provider is not loaded as participating until the credentialing committee approves the file, which means a signed provider is not yet a provider members can see, the directory can list or claims can pay in network.

So the question a VP of network development should ask is not "how many contracts do we have?" It is "how many providers will be credentialed and loaded by the date we need them?"

Those are different numbers. On builds we have run, the gap between them is widest in exactly the specialties that are hardest to recruit, because the providers who took longest to sign are also the ones whose files arrive last. Behavioral health groups with many individual clinicians are the usual example: every clinician is a separate file, and each one needs its own complete set of documents before anything moves.

State laws that put a clock on the plan

Several states set a deadline for insurers to decide on a credentialing application. Every one of them starts the clock at a complete or clean application, which is the most important detail in this section.

State	What the law requires	Citation
Virginia (carriers)	Approve or deny within 60 days of a completed application. From January 1, 2024, an application is deemed complete within 30 days unless the carrier gives notice. Claims for services during a pending application must be paid within 40 days after credentialing and contracting.	Va. Code 38.2-3407.10:1
North Carolina (insurers)	Assess and verify within 60 days of a completed application. If undecided at 60 days, issue a temporary credential within 5 business days of a written request, subject to exclusions.	N.C.G.S. 58-3-230(a)
New York (health care plans)	Notify within 60 days of a completed application. If third-party documents are missing, decide within 21 days of receiving them. Newly licensed or relocating professionals joining a participating group can be provisionally credentialed after 60 days.	N.Y. Pub. Health Law 4406-d(1)
Kentucky (Medicaid)	The state enrolls a provider within 60 calendar days of a clean application. A recognized MCO credentialing alliance's CVO completes verification and committee review within 30 days of a clean application. The MCO decides whether to contract within 30 calendar days of receiving verified information and loads the contract within 10 days (plus 15 more with notice).	KRS 205.532

Colorado's statute, C.R.S. 10-16-705.7, sets 60 calendar days for carriers to conclude credentialing after a completed application, with receipt acknowledged within 7 days and notice of an incomplete application within 10. We have read it only as reproduced on FindLaw, so confirm it on the state legislature's site before relying on it.

Look at what these laws do not cover: the time between "we'd like you in our network" and "your application is complete." That stretch is on nobody's clock but yours. In our experience it is where most of the calendar goes. A missing malpractice face sheet, an expired CAQH attestation or an unsigned release can hold a file for weeks before any statute starts counting. Most of these laws govern commercial insurers, too. Kentucky's is Medicaid-specific. Check your own state.

NCQA's 2025 verification time limits

NCQA announced shorter verification time frames in August 2024, saying the old limits dated from manual processes. The new limits apply to files processed on or after July 1, 2025. Files processed earlier are scored against the previous limit, which NCQA's 2025 policy updates give as 365 calendar days for the elements they amend. NCQA's standards measure a verification's age at the time of the credentialing decision. This is NCQA's own table from its September 2025 credentialing e-book:

Credential	Credentialing Accreditation	Credentialing Certification (CVO)
License to practice	180 days	90 days
Board certification	120 days	90 days
Work history	180 days	120 days
Malpractice history	120 days	90 days
State licensing sanctions	120 days	90 days
Medicare/Medicaid sanctions	120 days	90 days
Credentialing application attestation	180 days	120 days
Medicare/Medicaid exclusions	120 days	90 days

Ignore summaries that describe a single flat limit. NCQA's table is element by element. If your plan holds Health Plan Accreditation rather than Credentialing Accreditation, check the element limits in the HPA standards you purchased, because they are not public.

Here is why the table matters for a build calendar. This is an illustrative file at a plan held to the Credentialing Accreditation limits, and the arithmetic is ours. The attestation is signed on day 5, license and board certification are verified on day 12, malpractice history and sanctions on day 15, and work history on day 20. Board certification expires on day 132, malpractice and sanctions on day 135, license on day 192. The file has to reach committee by day 132, or someone re-runs verifications. The earliest-expiring element sets the deadline, and a file that sits waiting on one document is quietly aging out.

After that, NCQA requires recredentialing at least every 36 months, and its e-book describes monthly monitoring of practitioner sanctions, license expiration, complaints and quality issues for Credentialing Accreditation.

Can a provider see patients before credentialing is complete?

Sometimes, depending on the program and the state.

In Medicaid, keep two processes apart. Plan credentialing follows the uniform credentialing and recredentialing policy each state must set under 42 CFR 438.214(b). Separately, under 42 CFR 438.602(b), the state must screen and enroll every network provider of its MCOs, PIHPs and PAHPs. Plans may execute network provider agreements pending the outcome of that state screening for up to 120 days. If the state says the provider cannot be enrolled, or one 120-day period ends without enrollment, the plan must terminate the agreement immediately and notify affected enrollees. That is a real window, and it is also a real risk if you start members with a provider whose enrollment stalls. States must also revalidate provider enrollment at least every 5 years under 42 CFR 455.414.

In commercial lines, a few state laws create their own bridges. North Carolina's temporary credential and New York's provisional credential for new or relocating group members are in the table above, and Virginia requires payment for services rendered while a complete application was pending, once the provider is credentialed and contracted. Outside those rules, the answer comes from your contract and your credentialing policy. Assume no until someone shows you the clause.

CAQH re-attestation: the 120-day clock that stalls files

Most plans pull practitioner data from CAQH ProView, which now carries the DataSpring name. Providers must re-attest every 120 days (180 days for Illinois providers), and a profile moves to Expired status after 120 days without attestation, according to the CAQH provider user guide. That guide dates from 2023, so confirm nothing changed with the rebrand.

An expired profile is one of the most common reasons a file that looked complete is not. It is also the easiest to prevent: check the attestation date the day the contract comes back, and if it expires inside your processing window, ask for re-attestation before you pull the data.

How to take weeks off the calendar

1. Send the credentialing packet with the contract. Start the file the day the contract is signed, not after it is loaded. Our list of what to collect when onboarding a provider covers what belongs in it.
2. Define complete in writing. State clocks start at a complete application. Publish your checklist to providers so "complete" means the same thing on both sides.
3. Check CAQH attestation at intake. If it expires within your expected processing time, get it refreshed first.
4. Track the earliest-expiring verification on every file. Schedule committee against that date, not against the order files arrived.
5. Never let one missing document stall a whole group. Credential practitioners individually. The twelve clinicians with complete files go to committee while you chase the thirteenth.
6. Run Medicaid state enrollment in parallel. If you use the 438.602(b) window, record the start date and put the 120-day end date on someone's calendar.
7. Put committee dates on the build plan. A file finished two days after committee waits for the next one.
8. Keep credentialing status on the recruiting record. The person who won the contract should see, without asking, that the provider is still weeks from counting.

Credentialing will never be the exciting part of a network build. It is the part that decides whether the build is on time. Treat the signed contract as the start of the clock, not the finish line, and your go-live date stops being a guess.

In Blueprint, credentialing status sits on the same provider record as the recruiting pipeline, so the build plan shows which signed providers are still weeks from counting. Blueprint tracks status. It does not perform primary source verification, which stays with your credentialing team or CVO. If you want providers to see their own checklist, our portal layouts show one way to do it, and you can see the pipeline in a demo.