Delegated Credentialing Requirements: What NCQA, CMS, and Payers Check Before You Qualify

If you run credentialing for a medical group, IPA, or hospital that contracts with four or more plans, this applies to you. Delegation lets you approve a new hire on your own committee calendar instead of waiting in each payer’s queue.

What are delegated credentialing requirements?

Delegated credentialing requirements are the conditions a provider organization has to satisfy before a health plan transfers credentialing work to it. The plan signs a delegation agreement, you verify and approve practitioners for its network, and the plan keeps final accountability to NCQA, CMS, and state regulators.

That last point shapes every rule below. Your payer still faces its own accreditation survey and CMS audits, so it can only hand the work to an entity that would pass the same review. Think of the whole qualification process as one question the plan keeps asking: if a surveyor pulled your files tomorrow, would they pass as ours?

Delegation covers verification and the credentialing decision. It doesn’t replace payer enrollment. Your practitioners still need Medicare and Medicaid enrollment through PECOS and state portals, which our Medicare and Medicaid enrollment team handles as a separate workflow.

Who can become a delegated credentialing entity?

Any organization that can credential to health plan standards can apply, but plans usually delegate to groups large enough to justify the oversight work. The usual candidates:

• Large medical groups and multispecialty practices
• Independent practice associations (IPAs) and physician hospital organizations
• Health systems and hospitals, typically through the medical staff office
• Management services organizations (MSOs) that credential for affiliated practices
• Credentialing verification organizations (CVOs), which usually take on verification only, not the approval decision

Each payer sets its own floor. Some want a minimum roster size. Some want NCQA Credentialing Accreditation or Certification. Others accept a clean pre delegation audit on its own. Ask each plan’s delegation oversight team for its written criteria and a sample agreement before you rebuild anything. Most will send both.

Does NCQA accreditation make you eligible faster?

Usually, yes. NCQA’s 2025 update merged Credentialing Accreditation and CVO Certification into a single credentialing program, with certification options for individual functions and an Interim Survey route that gives an organization 18 months to reach full accreditation.

Accreditation matters to payers because of automatic credit. When a delegate holds NCQA accreditation or certification for the delegated function, NCQA waives the plan’s pre delegation evaluation, semiannual reporting, annual evaluation, and annual information integrity evaluation for that delegate. Fewer audits for the plan means a faster yes for you.

One eligibility rule trips up groups that outsource heavily. NCQA won’t grant Credentialing Accreditation to an organization that delegates more than half of its credentialing decision making, and it allows more than 50 percent of verification to go to delegates only when every one of them is NCQA Accredited or Certified.

What are the NCQA delegated credentialing requirements?

NCQA expects a delegate to perform every delegated credentialing function exactly as well as the health plan would. The plan proves that through its delegation oversight standard (CR 9), so the plan’s auditors measure your program against CR 1 through CR 8.

What changed in the 2025 NCQA standards that payers test in 2026?

Three changes from the 2025 standards now drive most pre delegation findings.

1. Shorter verification windows. NCQA cut the verification window from 180 days to 120 days for accredited organizations and from 120 days to 90 days for certified CVOs. A verification dated day 121 fails the element.
2. Monthly monitoring. Ongoing monitoring moved to a monthly cadence for license status, OIG LEIE exclusions, SAM.gov sanctions, and state Medicaid exclusion lists. Quarterly batch checks no longer meet the bar, so confirm the exact cadence your delegation agreement names.
3. Information integrity. Delegation agreements that took effect on or after July 1, 2025 must spell out credentialing information integrity requirements, and auditors now ask who can edit a verification date and how you’d catch it.
4. Interim Survey path. Organizations can now earn interim status while they build toward full accreditation, which gives payers an earlier signal of readiness.

Here’s our take. The 120 day window catches more groups than any other change, and the cause is rarely the verification itself. A committee that meets quarterly can push a clean file past day 120 on calendar math alone. Move to monthly meetings, or give your medical director clean file approval authority, before you invite an auditor in.

What are the CMS delegated credentialing requirements?

CMS doesn’t approve delegates directly. It regulates Medicare Advantage organizations and Medicaid managed care plans, and those plans write the federal rules into your delegation agreement as flow down terms.

Medicare Advantage: 42 CFR 422.204

Under 42 CFR 422.204, initial credentialing needs a written application, primary source verification of licensure or certification, disciplinary status, eligibility for Medicare payment, and site visits where appropriate. CMS training material sets recredentialing at every three years and states plainly that the plan keeps ultimate responsibility for credentials even after it delegates.

• No employment of or contracts with practitioners excluded from Medicare
• Compliance with the opt out rules at 42 CFR 422.220
• A documented process for the CMS Preclusion List under 42 CFR 422.222

Medicare Advantage delegation contracts: 42 CFR 422.504(i)

The delegation clauses in 42 CFR 422.504(i) shape the contract you’ll sign. Expect these terms in every Medicare Advantage agreement:

• A written list of the delegated activities and your reporting duties
• The plan’s right to revoke delegation if you perform poorly
• Ongoing monitoring of your performance by the plan
• For credentialing specifically, the plan either reviews each practitioner’s credentials or reviews and approves your process and audits it on an ongoing basis
• The plan’s right to approve, suspend, or terminate any provider you select
• Access for HHS and the Comptroller General to your books and records, with a 10 year audit window

Medicaid managed care: 42 CFR 438.214 and 438.230

For Medicaid, 42 CFR 438.214 makes each state publish a uniform credentialing and recredentialing policy that every MCO, PIHP, and PAHP follows. Plans can’t contract with excluded providers and must terminate providers that Medicaid, Medicare, or CHIP has terminated. Section 438.230 then requires a written subcontract, ongoing monitoring, and the right to revoke delegation.

States add their own layer. Ohio’s Medicaid rule, for example, requires a delegate to hold an approved delegation contract, pass a pre delegation audit, and run its own credentialing committee with decision making authority. Picture a 60 provider orthopedic group in Tampa holding contracts with three Florida Medicaid MCOs. The same practitioner file has to satisfy NCQA, CMS, Florida’s contract language, and three slightly different checklists. Build to the strictest one.

What do payers check before granting delegation?

Payers run a pre delegation evaluation that combines a document review, a file audit, and sometimes a site visit or virtual walkthrough. Expect a request list close to this one:

• Credentialing and recredentialing policies and procedures
• Credentialing criteria by practitioner type
• Committee charter, roster, and recent minutes
• A current practitioner roster with credentialing and recredentialing dates
• A sample of initial and recredentialing files for the 8/30 audit
• Ongoing monitoring logs and evidence of action on findings
• Information integrity policy, access controls, and training records
• Any sub delegation agreements, such as a contract with a CVO

How does the NCQA 8/30 file audit work?

The 8/30 method is NCQA’s file sampling rule. The auditor randomly selects 30 files and reviews the first 8. If all 8 meet every element, the element passes. If any of the 8 fails, the auditor reviews all 30 and scores the full sample.

Plans often go further. Louisiana Healthcare Connections, for instance, pulls 30 initial files and 30 recredentialing files, reviews every file when a delegate has fewer than 30 in a category, and draws its sample from up to three years back. So don’t plan to fix only your newest files.

What score do you need to pass?

Many plans set the passing bar at 95 percent. Canopy Health and Macomb County Community Mental Health both publish a 95 percent threshold in their delegation policies. Fall short and you’ll get a corrective action plan and a follow up audit, or a flat no.

Timing matters too. Plan policies commonly require the pre delegation evaluation within 12 months before delegation starts. If contracting drags past that, the plan audits you again.

Standard credentialing vs delegated credentialing

How do you become a delegated credentialing hospital?

A hospital’s medical staff office gives you a head start, not a pass. Privileging runs under your medical staff bylaws, the CMS Conditions of Participation, and Joint Commission standards. Payer delegation runs under NCQA health plan standards and the plan’s contract, and the two systems ask different questions.

Hospitals tend to underestimate the roster problem. Your medical staff office knows every surgeon with privileges. It often has no file at all for the nurse practitioner working in an employed primary care clinic across town, and that NP sits squarely inside the payer’s delegated scope.

Most hospitals close the gap with a payer facing credentialing committee (or a revised charter), NCQA practitioner rights language, 120 day verification tracking, monthly monitoring logs, and roster reporting for each plan. Keep privileging files clean in parallel; our hospital privileging support covers that side, from OPPE and FPPE records to delineation of privileges.

How do you qualify for delegated credentialing? A 7 step path

1. Collect each payer’s criteria. Ask for the written delegation requirements, the audit tool, and a sample agreement.
2. Run a gap assessment. Score your program against CR 1 through CR 8, then layer on CMS and state flow down terms.
3. Fix governance first. Rewrite policies and charter a committee that holds decision authority for plan participation.
4. Rebuild the verification workflow. Track every file against the 120 day clock and switch sanctions monitoring to monthly.
5. Lock down information integrity. Set role based access, keep audit logs on verification fields, and train staff every year.
6. Self audit with the 8/30 method. Fix every failed element and document the fix before the payer arrives.
7. Pass the pre delegation audit and sign. Then set a reporting calendar for rosters, semiannual reports, and the annual audit.

One opinion we’ll stand behind: if you plan to hold delegation with four or more plans, pursue NCQA Credentialing Accreditation. Automatic credit spares you a stack of duplicate pre delegation audits, and payers move accredited delegates through contracting faster.

What happens after a payer approves delegation?

Approval starts an oversight cycle that never really stops. Plan on these obligations from month one:

• Semiannual reporting at minimum. NCQA requires it, and many plans want monthly or quarterly rosters of new, recredentialed, terminated, and denied practitioners.
• An annual file audit and performance evaluation against NCQA standards, unless you hold accreditation that earns automatic credit.
• Corrective action plans for any element that fails, with a follow up audit.
• Revocation risk. Both 42 CFR 422.504(i) and 438.230 give plans the right to pull delegation for poor performance.
• Sub delegation oversight. If you hand verification to a CVO, you inherit the plan’s oversight duties toward that CVO.

Recredentialing deserves its own calendar. A single file that slips past month 36 shows up in the next annual audit, and our recredentialing tracking service starts every renewal 90 days early for that reason.

Why go through all of this? Every month a new hire waits on payer credentialing, the practice carries salary without collections. Our breakdown of the 60 to 90 day revenue gap shows how fast that adds up, and delegation is the most direct fix for groups that hire often. For the fundamentals of how delegation works day to day, see our guide to how delegated credentialing works.

Delegated credentialing FAQs

What are delegated credentialing requirements?

Delegated credentialing requirements are the standards a provider organization must meet before a health plan lets it credential practitioners for the plan’s network. They include NCQA compliant policies, a credentialing committee, primary source verification within 120 days, recredentialing every 36 months, monthly sanctions monitoring, information integrity controls, CMS and state flow down terms, and a passing pre delegation audit.

What are the CMS delegated credentialing requirements?

CMS sets them through the health plan. For Medicare Advantage, 42 CFR 422.204 requires a written application, primary source verification of licensure, disciplinary status, Medicare eligibility, and recredentialing every three years. Section 422.504(i) requires a written delegation agreement, ongoing monitoring, revocation rights, and plan review or audit of your credentialing process. Medicaid plans follow 42 CFR 438.214, 438.230, and state rules.

Does a delegate need NCQA accreditation?

No. A health plan can delegate to an organization without NCQA accreditation, but the plan must then complete a pre delegation evaluation, semiannual report reviews, and an annual audit and evaluation. When the delegate holds NCQA Credentialing Accreditation or Certification for the delegated function, the plan earns automatic credit and skips most of that oversight, so payers usually approve accredited delegates faster.

What is the NCQA 8/30 rule?

The 8/30 rule is NCQA’s file audit sampling method. The auditor randomly selects 30 credentialing files and reviews the first 8. If all 8 meet every element, the element passes. If any one fails, the auditor reviews all 30 files and scores the full sample. Payers use the same method in pre delegation and annual audits, often with a 95 percent passing bar.

Can a hospital become a delegated credentialing entity?

Yes. Hospitals and health systems commonly hold delegation, usually through the medical staff office. They need more than privileging files, though. Payers expect a committee with authority over plan participation, NCQA practitioner rights notices, 120 day verification tracking, monthly monitoring, and files for every delegated practitioner, including employed clinic providers who never request hospital privileges.

How long does it take to become a delegated credentialing entity?

Plan on several months. Payers want to see finished files and committee minutes produced under your updated process. New policies alone won’t pass, and many plans require the pre delegation evaluation within 12 months before delegation begins. Organizations that already meet NCQA standards, or hold NCQA accreditation, move through the payer review much faster than groups rebuilding their program.

Can a delegated entity use a CVO?

Yes. Many delegates sub delegate primary source verification to a credentialing verification organization and keep the approval decision with their own committee. You then carry the oversight duties toward the CVO that the plan carries toward you. Choosing an NCQA Certified CVO earns automatic credit and removes most of that extra oversight work.

What happens if you fail a pre delegation audit?

The plan usually issues a corrective action plan that lists each failed element and a deadline, then schedules a follow up audit. Some plans simply decline delegation and keep credentialing your practitioners themselves. Fix the root cause, such as committee timing or missing attestations, rather than only the sampled files, because the next audit pulls a fresh sample.

Sources and regulations referenced: 42 CFR 422.204 (eCFR); 42 CFR 422.504(i) (eCFR); 42 CFR 438.214 (eCFR); NCQA Health Plan Accreditation and Credentialing Accreditation standards, 2025 and 2026 editions, and NCQA delegation oversight automatic credit guidance. This article explains credentialing requirements for administrative and compliance planning. It isn’t legal advice. Confirm final terms against each payer’s delegation agreement and current NCQA standards.