CMS Pub. 100-16, ch. 6, § 60.3

An MA organization must have written policies and procedures for the selection and

evaluation of health care professionals that conform with the following credentialing

requirements and the provider anti-discrimination policy discussed directly above.

Credentialing is the review of qualifications and other relevant information pertaining to

a health care professional who seeks appointment (in the case of an MA organization

directly employing health care professionals) or who seeks a contract or participation

agreement with the MA organization. Note that MA organization oversight of

credentialing in contracted, subcontracted, and other related entities is an MA

organization contract requirement imposed by 42 CFR 422.502(i)(4)(iv) and is addressed

further in Chapter 11, “Contracts With Medicare Advantage Organizations.”

Credentialing is required for:

• All physicians who provide services to the MA organization’s enrollees,

including members of physician groups; and

• All other types of health care professionals who provide services to the MA

organization’s enrollees, and who are permitted to practice independently under

state law.

Credentialing is not required for:

• Health care professionals who are permitted to furnish services only under the

direct supervision of another practitioner;

• Hospital-based health care professionals who provide services to enrollees

incident to hospital services, unless those health care professionals are separately

identified in enrollee literature as available to enrollees; or

• Students, residents, or fellows.

Initial Credentialing

Procedures for initial credentialing involve a written application; verification of

information from primary and secondary sources; confirmation of eligibility for payment

under Medicare; and site visits as appropriate. A limited set of procedures for newly

trained health care professionals permits initial credentialing for a period of up to 60

days.

Written Application

The credentialing process begins with the completed application and attestation of

correctness signed by the health care professional. The application must be signed, dated

and include an attestation by the applicant of the correctness and completeness of the

application. The information collected must be no more than six months old on the date

on which the health care professional is determined (for example, by a credentialing

committee) to be eligible for appointment or contract. All items must be verified prior to

the appointment of the health care provider, with the exception being in the case of a

pending Drug Enforcement Agency (DEA) number.

The application includes a work history covering at least 5 years and a statement by the

applicant regarding: (1) Any limitations in ability to perform the functions of the

position, with or without accommodation; (2) History of loss of license and/or felony

convictions; and (3) History of loss or limitation of privileges or disciplinary activity.

(NOTE: Work history refers to relevant work that is applicable to the position being

sought. If the applicant is a new health care professional, he/she may not have 5 years of

relevant work history.)

Verification of Information

Some information may be verified from a primary source and some information may be

verified from secondary sources. A “primary source” is an organization or entity with

legal responsibility for originating a document and ensuring the accuracy of the

information it conveys. Primary source verification may be achieved through the use of

industry-recognized verification sources. The nationally recognized accrediting

organizations specify which sources they consider to be appropriate primary sources for

verifying credentials. In some instances, except for licensure, a secondary source will be

considered acceptable provided that the secondary source verifies the information from

the originator. If the MA organization uses one of the primary sources identified by one

of these nationally recognized accrediting organizations, CMS will consider that source

acceptable. If questioned, the MA organization should be able to reference which

organization identified that source. In addition, although the National Practitioner Data

Bank (NPDB) does not have any legal responsibility for issuing a document, it is

generally considered an appropriate source of verification by most private accrediting

organizations as well as by CMS.

Primary Source Verification Required

An MA organization must verify the following from primary sources and include in the

credentialing records:

1. A current valid license to practice: Verification must show that the license was in

effect at the time of the credentialing decision.

2. Education and training records, including evidence of graduation from the

appropriate professional school and completion of a residency or specialty

training, if applicable: Verification is required only for the highest level of

education or training attained. For example, health care professionals who have

completed residency, then the verification from the residency program is the

highest credential to be verified, and for those who only completed medical

school, the medical school verification must be obtained. When verifying the

highest level of education or training through primary sources, the assumption is

that all other education or training requirements prior to the highest level

achieved have been met. This assumption is consistent with current credentialing

practices.

3. Board certification in each clinical specialty area for which the health care

professional is being credentialed if he/she states that he/she is board certified on

the application: If board certification is verified, CMS will accept this as also

satisfying the requirement to verify education and training, provided that board

uses primary source verification for education and training.

Primary Source Verification Not Required

Following are other credentialing requirements that must be verified and included in the

credentialing files. Previously, these requirements also stipulated primary source

verification. This change from primary source to secondary source aligns these

requirements with current industry standards. Secondary sources of information for these

requirements are widely accepted and appropriate. The sources of and methods for

obtaining the designated credentialing requirements listed below are suggested

appropriate sources/methods; however, this is not intended as an all-inclusive listing of

sources/methods that an MA organization may employ to acquire the requisite

information.

1. Clinical privileges in good standing at the hospital designated by the health care

professional as the primary admitting facility if the physician or other health care

professional has admitting privileges: Health care professionals who have the

ability to have admitting privileges may choose not to have them, as they may not

manage care in the inpatient setting. However, if a health care professional does

have admitting privileges, he/she is required to list those privileges. Lack of

privileges does not exclude a health care professional from participation in a MA

organization. Information obtained by an MA organization on applications from

physicians and other health care professionals that lists the current status and type

of admitting privileges would meet this requirement. (This information may be

obtained by contacting the facility, obtaining a copy of the practitioner directory

or attestation by the health care professional.)

2. Current, adequate malpractice insurance meeting the MA organization’s

requirements: (This information may be obtained via the malpractice carrier, a

copy of the insurance face sheet or attestation by the health care professional.)

3. A valid Drug Enforcement Agency (DEA) or Controlled Dangerous Substances

(CDS) certificate in effect at the time of the credentialing decision: However, if a

health care professional’s DEA certificate is pending, the MA organization may

credential the practitioner provided the MA organization has adopted and

implemented a process under which other DEA-certified contracted practitioners

write all prescriptions that require a DEA number. The process must also include

verification of the newly issued DEA certificate. If a health care professional

states that he/she does not prescribe, this requirement is not applicable. (This

information can be obtained through confirmation with CDS, entry into the

National Technical Information Service (NTIS) database, or by obtaining a copy

of the certificate.)

4. A history of professional liability claims that resulted in settlements or judgments

paid by or on behalf of the health care professional: (This information can be

obtained from the malpractice carrier or from the National Practitioner Data

Bank.)

5. For physicians, any other information from the National Practitioner Data Bank.

6. Information about sanctions or limitations on licensure from the applicable state

licensing agency or board, or from a group such as the Federation of State

Medical Boards.

7. Eligibility for participation in Medicare. (See excluded and opt-out provider

checks above.)

Site Visits

The MA organization must establish a policy for conducting site visits. It is the

responsibility of the MA organization to decide the frequency of site visits, as part of its

site visit policy. The CMS does not, however, require MA organizations to conduct

initial credentialing or recredentialing site visits. Each MA organization’s site visit

policy will be reviewed pursuant to CMS’ monitoring protocol.

An MA organization’s site visit policy must include procedures for detecting deficiencies

and have mechanisms in place to address those deficiencies. At a minimum, the MA

organization should consider requiring initial credentialing site visits of the offices of

primary care practitioners, obstetrician-gynecologists, or other high-volume providers, as

defined by the MA organization. If the organization chooses to conduct site visits for

“high volume” providers, the organization’s procedures may specify the criteria for

determining that a provider is “high-volume”. The organization may also consider

developing criteria that target high-volume providers, or those against whom grievances

have been filed.

The site visit should include an evaluation of the site’s accessibility, appearance, and

adequacy of equipment, using standards developed by the MA organization. Each MA

organization must send appropriately qualified personnel to conduct site visits. Those

personnel may or may not be clinicians, depending on the focus of the evaluation and the

evaluation criteria established by the MA organization.

In addition, the visits should include a determination of whether the site conforms to the

MA organization’s standards for medical record keeping practices and the confidentiality

requirements discussed in Chapter 4. Although CMS is not establishing a methodology

for conducting medical record reviews, each MA organization is directed to verify that its

practitioners’ enrollee health records meet its own standards.

Initial Requirements for a Newly Trained Health Care Professional

In an effort to promote access to services for beneficiaries and allow a newly trained

healthcare professional to begin providing care at an earlier date, CMS has established a

temporary, streamlined credentialing guideline for these newly trained individuals. In the

case of a newly trained health care professional who has completed all appropriate

training and education within the last 12 months, the MA organization may establish a

policy that permits initial credentialing for a period of up to 60 days if the MA

organization:

1. Verifies that the practitioner has a current, valid license from primary sources;

2. Verifies malpractice settlements from the last 5 years. (This may be done by

verifying with the malpractice carrier or the National Practitioner Data Bank;

attestation is not accepted.);

3. Has a policy and procedure which ensures that the practitioner meets all standard

credentialing requirements after 60 days; and

4. Ensures that the Credentialing Committee has reviewed the case and makes the

final determination about granting such an initial 60-day credentialing period.

Monitoring

The MA organization must develop and implement policies that address the ongoing

monitoring of sanctions and grievances filed against health care professionals. The MA

organization must regularly obtain and review reports and other documentation as

indicated below. The MA organization must also provide, through documentation,

evidence that its policies have been implemented.

The CMS requires ongoing monitoring of lists of practitioners who have been sanctioned

and of practitioners who opt-out of accepting Federal reimbursement from Medicare (see

above for details), as well as ongoing monitoring and resolution of beneficiary

grievances. In addition to these standing requirements, MA organizations are also

required to monitor sanctions and limitations on licensure on a regular basis between

recredentialing cycles.

In the event that an MA organization finds an incidence of poor quality or any type of

sanction activity against a health care professional, it should intervene and correct the

situation appropriately.

If the MA organization becomes aware of conditions at a site that suggest compromised

safety or other concerns related to the delivery of care, the MA organization will be

expected to perform a site visit as soon as possible to assess the facility and identify

corrective actions.

While the MA organization is required to ensure that all credentialing requirements are

current at the time of initial credentialing and/or recredentialing, the MA organization is

not required to monitor and account for any expiration dates on a continuous basis unless

required to do so by the state.

Recredentialing

The MA organization must have procedures for recredentialing, at least every 3 years,

through a process that updates information obtained in initial credentialing, considers

performance indicators such as those collected through the QAPI program, the utilization

management system, the grievance system, enrollee satisfaction surveys, and other

activities of the MA organization, and that includes an attestation of the correctness and

completeness of the new information.

Licensure must be re-verified from primary sources. Board certification must be re-verified only if the provider was due to be recertified or states that he/she has become

board certified since the last time he/she was credentialed or recredentialed. The

following must also be re-verified in the same manner as performed under the Initial

Credentialing Requirements: admitting privileges; malpractice coverage; and DEA/CDS

certificate. In addition, the MA organization must perform another search of the National

Practitioner Data Bank and obtain updated sanction or restriction information from

licensing agencies and Medicare (see above for details). If a provider is confirmed

eligible to participate in Medicare, the MA organization should require that a provider,

who has been otherwise disciplined, have a corrective action plan in place, and the MA

organization should have procedures to ensure that the provider’s plan is followed and is

effective. The MA organization is not required to conduct site visits as part of its

recredentialing policies, but may choose to do so at its own discretion.

(Source: 42 CFR 422.204(b)(2)(i) and (ii) and additional instructions)