How to Organize Provider Credentialing Documents

TL;DR: Keep one credentialing file per provider, with the same subfolders for each: licenses, DEA or CDS registration, education and training, board certification, work history, malpractice insurance and claims history, and payer enrollment. Put the expiration date in every file name. Under NCQA standards, providers are recredentialed at least every 36 months, and license and sanction status should be monitored between cycles. Most missed renewals come from dates that live only inside PDFs.

Credentialing is mostly document management with deadlines attached. A practice with 15 providers is tracking dozens of licenses, registrations, certifications and insurance policies, each renewing on its own date, plus payer enrollment for each provider with each plan.

A note on scope: this is about provider credentialing records, not patient records. Patient health information belongs in your EHR, under HIPAA, and isn't covered here.

What goes in a provider credentialing file?

NCQA's credentialing elements give a good outline. They include "License to Practice," "DEA or CDS Certification," "Education and Training," "Board Certification Status," "Work History," "Malpractice Claims History," "State Licensing Board Sanctions," and "Medicare/Medicaid Sanctions," along with the application and attestation. (NCQA Credentialing guide, 2025)

In practice, a file usually holds:

• Application and signed attestation
• State medical or professional licenses, for every state
• DEA registration and state controlled substance (CDS) registration
• Education and training: diplomas, residency and fellowship certificates
• Board certification
• CV and work history, with explanations for gaps
• Malpractice insurance certificate and claims history
• NPI and payer identifiers
• Primary source verifications and the dates they were done
• Payer enrollment approvals and recredentialing letters
• Hospital privileges, where applicable

NCQA expects credentials to be verified "through a primary source, through a recognized source or through a contracted agent of the primary source," so keep the verification records, not just the provider's copies.

How often do providers need to be recredentialed?

At least every 36 months under NCQA standards, and NCQA is firm that the organization "may not extend the 36-month recredentialing cycle," with narrow exceptions such as active military duty or medical leave. (NCQA FAQ) NCQA also calls for monthly monitoring of sanctions and license expirations between cycles.

That means the dates that matter aren't just the recredentialing date. Licenses, DEA registrations, board certifications and malpractice policies each expire on their own schedule, and a lapse in any of them can affect billing.

How should credentialing files be organized?

Credentialing/
  Providers/
    Patel, Anika MD - NPI 1234567890/
      01 Application and Attestation/
      02 Licenses/
      03 DEA and CDS/
      04 Education and Training/
      05 Board Certification/
      06 Work History and CV/
      07 Malpractice/
      08 Verifications/
      09 Payer Enrollment/
  Former Providers/

Name every document with the type, provider, state or payer where relevant, and the expiration date: License - Patel - TX - Expires 2027-08-31.pdf. With the expiration in the name, a search across the folder becomes a renewal list.

Keep superseded documents (last cycle's license, the old malpractice certificate) in an Archive subfolder rather than deleting them; payers and auditors sometimes ask what was in force on a past date.

How do you track credentialing expiration dates?

The usual answer is a spreadsheet maintained by hand, and it drifts the first time someone renews a license and forgets to update the row.

A better source of truth is the documents themselves. The Drive AI can read every license, registration and certificate in the credentialing folders and build the list:

Read every document under /Credentialing/Providers and list the provider, document type, state, and expiration date. What expires in the next 90 days?

The agent reads each document, scans included, into a table, answers with what's coming due, and can export it to Excel. It also helps with the rest of the routine:

• Collect renewals from providers. A file request gives each provider one upload link for updated documents, no account needed.
• File new documents as they arrive. A workflow reads each upload, renames it with the expiration date, and files it under the provider and document type.
• Check completeness. Ask which providers are missing a current malpractice certificate or board certification document.

What it doesn't do: it isn't a credentialing verification organization, it doesn't run primary source verification or sanctions checks, and it doesn't submit payer enrollment. It isn't meant for patient health information. It keeps the credentialing documents organized and the dates visible.

File requests and connected drives come with the Max plan and Team plans. See also our healthcare page for the non-clinical records it's built for.

Credentialing is one part of the practice's paperwork; the rest is covered in how to organize a medical practice's business files.

Frequently Asked Questions

What documents are needed for provider credentialing?

Typically the application and attestation, state licenses, DEA and state controlled substance registrations, education and training certificates, board certification, CV and work history, malpractice insurance and claims history, NPI, primary source verifications, and payer enrollment records.

How often is recredentialing required?

At least every 36 months under NCQA standards. NCQA does not allow the cycle to be extended except in limited situations such as active military duty or medical leave.

What is primary source verification?

Confirming a credential directly with the organization that issued it, such as a state licensing board or medical school, or through a recognized or contracted source, rather than relying on the provider's copy.

How do I track provider license expirations?

Put the expiration date in each document's file name and keep a list generated from the documents themselves, so it updates when a renewal is filed. Review what expires in the next 90 days every month.

Should patient records be stored with credentialing files?

No. Credentialing files hold provider documents. Patient health information belongs in your EHR and is governed by HIPAA.

Start with what expires this quarter

Gather each provider's current license, DEA registration, board certification and malpractice certificate first. Those carry the dates most likely to interrupt billing. File them into the structure above, list what expires in the next 90 days, and fill in the rest of each file at recredentialing.