Provider Credentialing Services and Payer Enrollment

What Is the Difference Between Credentialing and Enrollment?

Credentialing is the check of a provider's license, training and history. Enrollment is the payer's approval for that provider to bill and be paid. Many people use the two words for the same job, and for billing purposes they are one project.

Medicare enrolls through its own CMS-855 application. Many commercial plans use the CAQH Provider Data Portal to receive a provider's credentialing data. Each payer decides what it needs, so the file for each one is different.

Hospital privileging is a different process from payer enrollment. This page covers payer credentialing and enrollment: Medicare, Medicaid and commercial plans.

How Does Medicare Enrollment Work, and Which CMS-855 Form Is Used?

Medicare enrollment is filed on a CMS-855 application, and the form depends on who is enrolling. The CMS enrollment applications page lists each form with its audience, and you can file online in PECOS or on paper.

The CMS-855R, the old reassignment form, is gone. The CMS-855I states: "All reassignment actions should now be reported via the CMS-855I. The CMS-855R (Reassignment of Medicare Benefits) form has been discontinued." Older checklists that still list the 855R are out of date.

PECOS is the Provider Enrollment, Chain and Ownership System, the online system CMS runs for enrollment. CMS says PECOS "is paperless" and that PECOS applications "tend to process faster than paper applications." Your Medicare administrative contractor (MAC) receives the application, and 42 CFR 424.510(d)(1) requires a complete application with supporting documentation.

Under 42 CFR 424.510(d)(2)(ii), the documentation that identifies a provider or supplier includes its NPI, if issued. The 855I and 855B pages of CMS list the other required details.

What Are the Steps to Enroll a Provider in Medicare?

The steps below follow the Medicare process in order. The same pattern of form, documents, filing and follow-up applies to the other payers, with their own forms.

What Is the Effective Date, and Can a Provider Bill Before Enrollment Is Complete?

For physicians, non-physician practitioners and several other supplier types, billing privileges start on the later of two dates. Under 42 CFR 424.520(d)(1), those are the date a Medicare contractor received an application that was later approved, or the date the provider first began furnishing services at a new practice location.

Retroactive billing is limited. Under 42 CFR 424.521(a)(1), a provider may bill retrospectively for services furnished at the enrolled location for up to 30 days before the effective date if circumstances precluded enrollment in advance. The window is up to 90 days when a Presidentially-declared disaster precluded enrollment.

Both retro windows require that the provider met all program requirements, including state licensure, when the services were given. Part (a)(2) applies the rule to 16 provider and supplier types, and physicians and non-physician practitioners are among them.

Institutional providers follow a different path. Under 42 CFR 424.520(a), the effective date for surveyed, certified or accredited providers is set by 42 CFR 489.13, not by the filing-date rule above.

For Medicaid and commercial plans there is no single national rule. The effective date comes from the state Medicaid agency or from the plan's contract and provider manual, so read those before scheduling a provider.

How Often Must Providers Revalidate, and What Changes Must Be Reported?

Medicare providers revalidate every 5 years, and CMS asks you to respond within 60 days of its notice. Under 42 CFR 424.515, a provider or supplier must resubmit and recertify its enrollment information every 5 years, and CMS contacts each one directly when it is time.

CMS can also revalidate off cycle. The same rule says CMS reserves the right to perform off-cycle revalidations in addition to the regular 5-year ones. DMEPOS suppliers have a 3-year cycle referenced in that rule.

Between revalidations, changes must be reported on time. Under 42 CFR 424.516(d), physicians, non-physician practitioners and their organizations report these within 30 days:

• A change of ownership.
• Any adverse legal action.
• A change, addition or deletion of a practice location.

All other changes in enrollment must be reported within 90 days under the same paragraph. A new location is therefore both an enrollment event and a 30-day reporting event.

State Medicaid has its own cycle. Under 42 CFR 455.414, the State Medicaid agency must revalidate the enrollment of all providers, regardless of provider type, at least every 5 years.

What Is the CAQH Provider Data Portal and How Often Must It Be Re-Attested?

The CAQH Provider Data Portal is the online profile many commercial plans use to receive a provider's credentialing data. Providers must re-attest it every 120 days, or every 180 days in Illinois, according to the CAQH quick reference guide.

The CAQH guide describes the portal as a free service to providers, where only the provider authorizes who may see the data. It lists supporting documents such as DEA certificates and W-9 forms that are uploaded into the profile.

We keep the 120-day date on our calendar for every provider we manage. Medicare enrollment is separate and uses the CMS-855 applications.

How Does Commercial Payer Credentialing Work?

Each commercial plan runs its own process and sets its own timeline. There is no national rule, and the plan's provider manual and contract are the authority for what it requires.

Where a plan uses CAQH, the provider authorizes that plan to see the profile, per the CAQH guide. Anything beyond that, such as the plan's own application or portal steps, comes from the plan itself.

Plan-level rules and contract terms are part of payer contracting. Eligibility checks tell you whether a payer has the provider on file, and you can read how we run them under eligibility verification.

We do not quote a typical duration here. No official source publishes a timeline, and vendor blogs that give months are not official.

PHP and IOP Credentialing: Payer Enrollment for PHP and IOP with Commercial and Government Payers

Intensive outpatient programs (IOP) and partial hospitalization programs (PHP) are structured day treatment programs for mental health and substance use disorders. Nucleus Align gets IOPs and PHPs approved and credentialed with commercial and government payers, at the facility level and at the individual provider level.

Medicare defines both as a distinct and organized intensive ambulatory treatment program with less than 24-hour daily care (42 CFR 410.2). Its coverage rules call for at least 20 hours of therapeutic services a week for PHP (42 CFR 410.43) and 9 hours for IOP (42 CFR 410.44). A commercial plan sets its own hours and definitions in its own policy.

Facility-Level Versus Individual-Level Credentialing

The example row comes from the Evernorth Behavioral Health network page and is not a rule for every plan.

What Documents and Steps Do Commercial Payers Usually Ask For?

As one published example, Evernorth asks for these items for each facility service location, all current and in good standing with no provisional approvals:

• A valid state license, certificate or permit to operate
• Liability insurance, at $1 million per occurrence and $1 million aggregate for PHP and IOP-only facilities
• Behavioral health accreditation (the Joint Commission and CARF are named) or Medicare certification
• A W-9 for each tax identification number (TIN)

For Medicare, PHP may be covered in a hospital outpatient department or a Medicare-certified community mental health center (Benefit Policy Manual, Chapter 6), using the CMS-855 forms above. Commercial plans set their own.

What Nucleus Align Does

We get IOPs and PHPs approved and credentialed with commercial and government payers at both levels. Once a program is approved, the claims run through our hospital and facility billing and behavioral health billing.

Do You Handle Medicaid Enrollment as Well as Medicare?

Yes, Medicaid enrollment is part of this service. Medicaid enrollment goes through the state Medicaid agency, so the state's own rules apply.

The one national rule we verified is the revalidation cycle. Under 42 CFR 455.414 the state agency must revalidate every provider at least every 5 years. The state's own provider enrollment page controls forms and timing, and our Medicaid payer guide covers the program in more detail.

How Are New Locations, Freestanding ERs and Group TINs Handled?

A new location is a change that needs two things: a Medicare update and a payer update for each plan. Under 42 CFR 424.516(d), adding a practice location is a 30-day reporting event for physicians and non-physician practitioners.

Linking an individual to a group is done through reassignment of benefits. The CMS-855I says an organization accepting a new reassignment must be enrolled, and the individual must also be enrolled, before the reassignment can take effect. The form has sections for both the individual practitioner and the organization or group.

For a freestanding ER or an urgent care site, line up the facility file and each provider's file before opening day. Our urgent care networks page covers that client type. Licensing and entity setup sits with licensing and business setup.

Prior authorization is a separate payer process, covered under prior authorization.

How We Handle Credentialing and Enrollment

Credentialing and enrollment is one of our 22 services, and we keep it in step with billing. We work from the official forms and rules cited on this page.

Every client has a Business Associate Agreement with us, our staff have HIPAA training and NDAs, and every system uses two-step login. Our fee for this work is on the pricing page, and it is charged separately from billing.

Ready to talk about your providers? Book a call.