How to evaluate credentialing and privileging software

What the software does

Credentialing confirms that a practitioner is who they say they are and holds the licenses, training and record the medical staff requires. Privileging decides what that practitioner may do at your organization. Software for this work is judged less by its screens than by whether the file it produces would satisfy a surveyor, a committee and your own bylaws. This guide sets out what to ask and test, without reference to any vendor.

Credentialing and privileging software supports the medical staff office from a practitioner's first application to reappointment. The core jobs are much the same across products:

• Collecting the application, attestation and supporting documents from the practitioner.
• Verifying credentials with the primary source (licensing boards, certifying bodies, training programs) or an approved equivalent, and recording who verified what, when and how.
• Querying the National Practitioner Data Bank and screening exclusion lists.
• Presenting department privilege forms and criteria, and routing the file through department chair, credentials committee, medical executive committee and governing body review.
• Tracking expiring licenses, certifications and other items between appointments, and running the reappointment cycle.
• Recording professional practice evaluation, and passing approved privileges to the teams that need them, such as EHR access and payer enrollment.

Some organizations use the same system for payer enrollment or for credentialing staff who are not on the medical staff. Decide early whether those are in scope, because they change the requirements and the evaluation team.

Who should be on the evaluation team

• Medical staff services: the manager and at least one credentialing specialist who works files every day.
• Medical staff leadership: a department chair and a credentials committee member, who will review files in the system.
• Quality or peer review staff, if professional practice evaluation will be recorded in it.
• Compliance and privacy, for exclusion screening, NPDB use and the handling of sensitive practitioner information.
• IT and identity, for single sign-on, integrations and data migration.
• Payer enrollment and EHR access teams, who depend on the verified data downstream.
• A practitioner who will complete an application and test it from the applicant's side.

Questions to ask and things to test

Ask each vendor to show these with your own data, not a prepared demonstration:

• Verification sources. List the boards, certifying bodies and other sources you use. Which can the software check automatically, and how are the rest recorded? What happens when a source is unavailable or changes its website?
• Evidence for surveyors. Pick one completed verification and ask what a surveyor would see: the source, the date, the person responsible and the document or screenshot retained.
• Your bylaws and committees. Configure your reappointment cycle, committee sequence and approval steps. Check how a change to the bylaws is reflected, and who can make that change.
• Privilege forms. Load one department's delineation of privileges and its criteria. See how a chair recommends privileges with conditions, and how a later change to the criteria is handled for existing practitioners.
• Ongoing monitoring. Ask how license expirations, exclusion list updates and NPDB reports are picked up between appointments, how often, and who is alerted.
• Hand-offs. Follow an approved file to EHR access and payer enrollment. Is the hand-off automated, a report or a manual step?
• Migration. Ask how existing practitioner files, verification history and documents will be moved and reconciled, and what happens to records that do not map cleanly.
• Access. Confirm which roles can see peer review, health and disciplinary information, and that the audit trail shows who viewed or changed a file.

Limits to probe

Every product in this category has boundaries. Ask vendors to state theirs in writing:

• Manual verifications. Some boards and certifying bodies offer no automated lookup, so part of every file is still verified by a person. Find out how much of your source list falls into this group.
• NPDB access. Queries are made under your organization's own NPDB registration. Ask whether the software queries the data bank directly or records results your staff obtain.
• Verification organizations. Software that helps you verify is not the same as a credentials verification organization that verifies on your behalf. Be clear which you are buying.
• Enrollment. Some products pass verified data to payer enrollment without submitting applications to payers.
• Quality data. Professional practice evaluation may be recorded in the system without measures being drawn automatically from the EHR.
• Ownership of criteria. Privilege criteria belong to your departments. The software holds them; your medical staff office keeps them current.
• Accreditation. A workflow can support accreditation standards, but meeting them remains your organization's responsibility.

Regulations and standards to understand

Confirm what applies to you in the current official text and with your accreditor and counsel. The main sources:

• CMS Conditions of Participation for hospitals. Under 42 CFR 482.22, the medical staff must periodically appraise its members and examine the credentials of all eligible candidates, and the bylaws must include criteria for determining the privileges granted to individual practitioners. It also covers relying on a distant site's credentialing of telemedicine practitioners; if you do, test how the software records it.
• National Practitioner Data Bank. 45 CFR 60.17 requires hospitals to request information from the NPDB when a practitioner applies for medical staff membership or clinical privileges, and every two years for those already on staff or holding privileges. The NPDB also offers a Continuous Query service.
• OIG exclusions. Federal health care programs pay nothing for items or services furnished, ordered or prescribed by anyone on the HHS Office of Inspector General's List of Excluded Individuals/Entities; the OIG advises checking it routinely.
• The Joint Commission. Accredited hospitals follow the manual's Medical Staff (MS) chapter, covering credentialing, privileging and focused and ongoing professional practice evaluation (FPPE, OPPE). Use your organization's licensed copy of the standards and the Joint Commission's standards FAQs.
• NCQA. Health plans and credentialing organizations may follow NCQA Credentialing Accreditation or Certification, which set their own verification and recredentialing time limits. If you credential for a health plan, test against current NCQA standards.

Implementation risks

• Migrating files. Practitioner files built up over years rarely map cleanly to a new system. Plan time to reconcile verification dates, expirables and privilege history, and decide what is migrated as data and what as scanned documents.
• Bylaws drift. If the workflow is configured from an outdated copy of your bylaws or rules, the system will enforce the wrong process. Have medical staff leadership sign off the configuration.
• Privilege forms. Rebuilding every department's delineation is often the longest task. Start early and agree who owns each form.
• Reappointment timing. Avoid going live in the middle of a heavy reappointment cycle, so files in flight are not caught between two systems.
• Overreliance on automation. Automated checks reduce manual work but do not remove the need for a specialist to review results, flags and sources that cannot be automated.
• Downstream dependencies. EHR access and payer enrollment teams may change how they work once data arrives from the new system. Include them in testing.

Related reading on this site

Requirement pages: The Joint Commission standards, CMS Conditions of Participation for hospitals (42 CFR Part 482), HIPAA.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.