The Credentialing and Privileging Process: From Application to FPPE

Credentialing and privileging are two different evidentiary questions answered by one sequential process — and most of the audit findings and delayed-start complaints a medical staff office deals with trace back to a step in that sequence being skipped, reordered, or documented informally. This page maps the process end to end: application intake, primary source verification, credentials committee review, medical executive committee recommendation, governing body approval, and the FPPE period that opens the moment a privilege is granted. For the document that records the privileging decision itself, see CASRAI’s delineation of privileges forms guide; this page covers the workflow that produces that document.

Credentialing verifies who; privileging decides what

Credentialing establishes identity and general qualification: is this person who they say they are, and do they hold a valid license, the training they claim, and a clean-enough history to be considered at all. Privileging is the separate, narrower decision that credentialing alone cannot answer: which specific procedures and clinical activities is this practitioner currently competent to perform, at this hospital, right now. A practitioner can clear credentialing completely and still not qualify for every privilege they request — competence for a specific procedure is not implied by a valid license and a clean file.

The federal floor for both sits in the hospital Conditions of Participation. 42 CFR 482.12(a)(6) requires the governing body to ensure selection criteria are based on “individual character, competence, training, experience, and judgment,” and 482.12(a)(7) prohibits granting staff membership or privileges “solely upon certification, fellowship, or membership in a specialty body or society.” 42 CFR 482.22(a)(2) supplies the process itself: the medical staff must “examine the credentials of all eligible candidates for medical staff membership and make recommendations to the governing body on the appointment of these candidates in accordance with State law” — the credentials-committee-to-board pipeline this page walks through is that requirement in practice.

Step 1: Application and self-disclosure

The practitioner submits a completed application — frequently pre-populated from a CAQH ProView or state-uniform-application profile to reduce duplicate data entry across the hospitals and payers a practitioner works with — covering identity, licensure history in every state ever held, education and training, work history with no unexplained gaps, board certification status, malpractice claims history, and self-disclosed adverse actions (license restrictions, privilege actions at other facilities, criminal history, health conditions affecting practice). The application itself is not evidence of anything; it’s the map of what primary source verification then has to independently confirm.

Step 2: Primary source verification

Primary source verification (PSV) means confirming a credential directly with the entity that issued it, or with a designated equivalent source the credentialing program has approved as reliable — not simply accepting a copy the applicant provided. What typically requires PSV in a hospital medical staff file:

• State medical license — verified directly with the issuing state licensing board, including current status and any history of disciplinary action.
• DEA registration — verified where the privilege requested involves prescribing controlled substances.
• Education and training — medical school and residency/fellowship completion verified with the institution or via a recognized verification service.
• Board certification — verified with the certifying board directly, or via an approved verification service, when certification is claimed as supporting evidence (never as the sole basis for a privilege — see 482.12(a)(7) above).
• Malpractice and claims history — verified with the malpractice carrier(s) or a claims-history reporting service.
• National Practitioner Data Bank query — mandatory at initial appointment and privileging for physicians and dentists, and again at least every two years thereafter, under 45 CFR 60.17(a). CASRAI’s NPDB reporting requirements guide covers the query obligation and the reporting side in full, including how continuous enrollment satisfies the periodic-query requirement automatically.
• Exclusion and sanction checks — the OIG List of Excluded Individuals/Entities and the federal SAM.gov exclusion list, checked at initial appointment and re-checked on an ongoing basis, since a Medicare/Medicaid exclusion has billing consequences independent of clinical competence.
• Peer references — typically from practitioners who have directly observed the applicant’s clinical work, addressing current competence rather than general character.

A source that cannot itself be reached directly (a closed training program, a foreign licensing body with no verification channel) is handled through a documented alternate-verification process, not simply waived — the credentials file should show what was attempted and why the alternate method was accepted, not just a blank field.

Primary source vs. designated equivalent source

Two verification paths satisfy PSV, and a credentials file should be explicit about which one was used for each element. A primary source is the entity that actually issued the credential — the state licensing board itself, the medical school or residency program itself, the certifying board itself. A designated equivalent source is a third-party verification service the credentialing program has formally pre-approved as a reliable stand-in for contacting the issuer directly — used because it is faster, or because the issuer has no practical direct-verification channel. It is not a shortcut a verifier invents on the spot; the credentialing program’s own policy has to name, in advance, which equivalent sources it accepts and for which element.

Commonly used designated equivalent sources in hospital credentialing include the American Medical Association (AMA) Physician Masterfile and the American Osteopathic Association (AOA) Physician Masterfile for MD/DO education and training history, the Federation of State Medical Boards’ (FSMB) Physician Data Center for cross-state licensure and disciplinary history, the American Board of Medical Specialties’ (ABMS) Certification Matters / ABMS Compass Verify for board certification status, the Educational Commission for Foreign Medical Graduates (ECFMG) for international medical graduates whose training institution has no direct verification channel, and the National Student Clearinghouse for degree verification of non-physician licensed practitioners (advanced practice nurses, physician assistants). A credentials verification organization performing delegated verification under a delegation agreement (see below) is itself functioning as a designated equivalent source for whatever it verifies on the hospital’s behalf — it is not a second layer that still needs separate primary-source confirmation on top of it.

Whichever path is used, the documentation standard is the same: the file needs to show what was verified, how (a written response from the source, a dated printout or screenshot from the source’s own verification database, or a documented telephone verification with the date, the name of the person contacted, and the method logged), and when — not just a checkbox marked complete. A phone verification with no record of who was called or when is functionally unverifiable to a surveyor after the fact, even if the call genuinely happened.

Step 3: Credentials committee review

Once the file is PSV-complete, a credentials committee — a standing medical staff committee, not the full medical staff — reviews it against the hospital’s bylaws-defined eligibility criteria and the specific privilege criteria for whatever is being requested (see CASRAI’s delineation of privileges forms guide for how those criteria should be written so this review has something concrete to check the file against, rather than a general competence judgment with nothing to point to later). This is the stage where volume thresholds, training pathway requirements, and any outcome-data criteria get checked line by line against what PSV actually turned up, and where a file with a gap, an unexplained lapse, or a threshold not quite met gets flagged for additional information rather than passed forward incomplete.

Step 4: Medical executive committee recommendation

The credentials committee forwards its findings and recommendation to the medical executive committee (MEC), which reviews the file at a higher level — consistency with medical staff bylaws, any input from department chairs on clinical fit, and whether the recommendation appropriately reflects what PSV and committee review actually found. The MEC’s own recommendation is what moves forward to the governing body; it is not itself a credentialing decision.

Step 5: Governing body approval

Final appointment and privileging authority rests with the hospital’s governing body (the board), per 482.22(a)(2) above — the medical staff recommends, the governing body decides. This is not a formality: the governing body is accountable under 482.12(a)(6) for the selection criteria actually being character, competence, training, experience, and judgment, and can decline a recommendation, though in practice this is rare once a file has cleared committee and MEC review cleanly. The approval date is the operative date for the privilege grant and the date FPPE begins.

Temporary and provisional privileges while the file completes

Hospitals commonly grant temporary privileges — for a new practitioner awaiting full committee/board processing, for a locum tenens covering a defined need, or in an emergency — once PSV on the load-bearing elements (current licensure, no active exclusion, no unexplained adverse action) is confirmed, even though the full file hasn’t completed every step above. This is a bridge, not a shortcut around verification: the NPDB Guidebook is explicit that “no distinction is made between temporary clinical privileges… and clinical privileges” for reporting purposes — an adverse action against a temporary privilege is reportable exactly as it would be against a standard one. A hospital that treats temporary privileges as lower-stakes because the paperwork is lighter is not reading that requirement correctly.

FPPE opens the moment a privilege is granted

Governing body approval doesn’t close the file — it opens Focused Professional Practice Evaluation (FPPE), the time-limited, privilege-specific evaluation period that converts “the file said this practitioner met the criteria on paper” into “the hospital observed this practitioner actually perform it competently, here.” Every newly granted privilege triggers FPPE, whether at initial appointment or added later at reappointment. Once FPPE closes out, the privilege moves to Ongoing Professional Practice Evaluation (OPPE) — continuous, lower-intensity monitoring that feeds the next reappointment cycle’s evidence. See CASRAI’s OPPE vs. FPPE comparison for the full mechanics of both, including data sources, the low-volume-practitioner problem, and how the two frameworks satisfy the periodic-appraisal requirement in 482.22(a)(1).

Reappointment: the same process, on a cycle

Credentialing and privileging are not one-time events. Reappointment repeats primary source verification on anything that can change (license status, sanctions, malpractice history, a fresh NPDB query) and re-evaluates each held privilege against accumulated OPPE data and continued volume/currency criteria rather than re-proving competence from a blank slate. A privilege with no supporting OPPE data at reappointment — because the practitioner simply never performed it — is a low-volume problem the reappointment review has to address explicitly, not a reason to renew it unexamined. The cycle length itself is set by each hospital’s own medical staff bylaws, in line with state law and the hospital’s accreditor; see CASRAI’s medical staff bylaws requirements guide for what the bylaws document needs to specify.

Delegated credentialing: CVOs shorten the file, not the accountability

Many hospitals delegate the PSV legwork to a credentials verification organization (CVO) — an internal system-level CVO or an external vendor — under a written delegation agreement, rather than having medical staff office generalists run every verification in-house. Delegating the verification work does not delegate the hospital’s own accountability for the decision: the credentials committee, MEC, and governing body still review and approve based on what the CVO verified, and the delegation agreement needs an oversight mechanism (file audits, a defined reporting cadence) so the hospital isn’t simply trusting the CVO’s output unchecked. This delegation relationship — what to put in the agreement and how to audit it — is its own topic; treat a CVO as a way to make Step 2 more efficient, not as a step you can skip evaluating.

A written delegation agreement should specify exactly which verification elements are delegated (license, DEA registration, board certification, NPDB query, OIG/SAM exclusion checks, malpractice history, and so on), the standards the CVO verifies against, the hospital’s right to audit a sample of completed files on a defined schedule, and the hospital’s right to reject or independently re-verify any file before it reaches the credentials committee. Many hospitals also look for a CVO — internal or external — that holds NCQA’s CVO Certification, which evaluates the CVO’s own verification processes against a published set of standards; certification simplifies vendor due diligence but does not replace the hospital’s own delegation oversight audit.

Where this process most commonly breaks down

• Temporary privileges treated as informal — granted without documenting which elements were actually PSV-confirmed before the grant, leaving nothing to show a surveyor if the temporary privilege is ever questioned.
• Credentials committee review that restates the application instead of checking it — a file summary with no record of what specifically was verified, against what criterion, is not evidence of review.
• Recommendations that don’t travel with their basis — the MEC or governing body approving a recommendation without the underlying PSV findings being visible to them, so the ultimate decision-maker under 482.12(a)(6) can’t actually see the evidence their decision rests on.
• Reappointment run as a paperwork renewal — re-verifying licensure and sanctions status is necessary but not sufficient; a reappointment that doesn’t pull in OPPE data for each held privilege isn’t actually re-evaluating competence.
• Delegated CVO output accepted without an audit trail — the hospital remains accountable for the credentialing decision even when a CVO did the verification work.

Frequently asked questions

What’s the difference between credentialing and privileging?

Credentialing verifies identity and general qualifications — license, education, training, board status, work history. Privileging is the separate decision about which specific procedures and clinical activities a practitioner may perform at a particular hospital, based on demonstrated current competence for each one requested.

Who makes the final decision to grant privileges?

The hospital’s governing body (board), per 42 CFR 482.22(a)(2) — the medical staff, through the credentials committee and medical executive committee, examines credentials and recommends; final appointment and privileging authority rests with the governing body.

What does primary source verification actually require?

Confirming a credential directly with the entity that issued it — the licensing board for a license, the training institution for education, the certifying board for board certification — or with a documented, approved equivalent source, rather than accepting a copy the applicant supplied.

What is a “designated equivalent source”?

A third-party verification service — such as the AMA/AOA Physician Masterfile, ABMS Certification Matters, the FSMB Physician Data Center, or a properly delegated CVO — that the credentialing program has formally pre-approved as a reliable stand-in for contacting the issuing license board, school, or certifying body directly. It is a documented, in-advance policy choice, not an ad hoc substitution made during file review.

What documentation does primary source verification need to leave behind?

A record of what was verified, the source contacted (primary or a named designated equivalent), the verification date, and the method used — a written response, a dated database printout or screenshot, or a logged telephone verification with the name of the person spoken to. A blank checkbox or an undated note is not sufficient if the file is ever reviewed at survey.

Do temporary privileges skip primary source verification?

No. Temporary privileges still require verification of the load-bearing elements (current licensure, absence of exclusion, no unexplained adverse action) before they’re granted, and the NPDB Guidebook treats an adverse action against a temporary privilege exactly the same as one against a standard privilege for reporting purposes.

What happens right after a privilege is granted?

Focused Professional Practice Evaluation (FPPE) opens for that specific privilege — a time-limited period in which the hospital observes actual performance rather than relying on the file alone. Once FPPE closes, the privilege moves to continuous Ongoing Professional Practice Evaluation (OPPE), which then supplies the evidence for the next reappointment cycle.

Does delegating verification to a CVO reduce the hospital’s accountability?

No. A credentials verification organization can perform the primary source verification work under a delegation agreement, but the hospital’s credentials committee, medical executive committee, and governing body remain accountable for the appointment and privileging decision itself, and the delegation agreement should include an audit mechanism rather than unreviewed reliance on the CVO’s output.

What is a credentials verification organization (CVO)?

A credentials verification organization is an internal shared-services unit or external vendor that performs primary source verification on behalf of one or more hospitals or health plans — contacting the issuing licensing board, medical school, residency program, and other primary sources directly, rather than relying on copies the applicant provides. A CVO can hold NCQA CVO Certification, but certification (or the lack of it) doesn’t change who is accountable: the delegating hospital’s credentials committee, medical executive committee, and governing body still own the final credentialing and privileging decision.

For the broader accreditation and survey-readiness picture, see CASRAI’s patient safety pillar, the CMS Conditions of Participation for hospitals guide, and the medical staff bylaws requirements guide.