Credentialing vs Privileging vs Enrollment: What Differs

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

Credentialing vs privileging vs enrollment comes down to who is approving what. Credentialing verifies a clinician's background. Privileging lets a hospital's medical staff authorize specific services. Enrollment gets the clinician accepted and billable with a payer. Each one is separate, and none replaces the others.

If you manage a practice, you will hear all three words in the same week, often used as if they meant one thing. They do not. A clinician can be fully credentialed and still be unable to bill a payer, and a clinician can be enrolled with Medicare and hold no hospital privileges at all.

The three terms side by side

Credentialing, privileging and enrollment each answer a different question, and a different organization answers it. The table below is the quick reference. The sections after it explain each one.

Source: RCM Finder summary of the definitions used in 42 CFR 482.22 (Cornell LII) and CMS PECOS guidance. General explanation, not legal advice.

What credentialing is

Credentialing is the review of a clinician’s qualifications by an organization that needs to rely on them. For a Medicare-participating hospital, federal rules say the medical staff must examine the credentials of all eligible candidates for medical staff membership, and the governing body makes the appointment after the medical staff’s recommendation (42 CFR 482.22, via Cornell LII, current text). A health plan does the same kind of review before it lists a clinician in its network.

In practice the review checks items such as licensure, training, work history and malpractice history against the original sources rather than the clinician’s own word. That step is usually called primary source verification. Which exact sources a plan or hospital uses is set by that organization, so ask for their list instead of assuming one.

Where the National Practitioner Data Bank fits

Our earlier version of this post said providers apply to the National Practitioner Data Bank. That was wrong. Providers do not apply to it. Hospitals query it. According to the NPDB page for hospitals, hospitals must query when a practitioner applies for medical staff appointment or clinical privileges, including temporary privileges, and again every two years for practitioners already on staff. The same page says hospitals are the only health care entities mandated by federal law to query the NPDB.

CAQH: the shared profile many plans use

Many practices first meet credentialing through CAQH. A clinician fills in one online profile and authorizes health plans to view it for credentialing, according to CAQH’s provider demo. That profile has to be attested again on a schedule. CAQH lists 120 days for credentialing attestation. One plan, Blue Cross Blue Shield of Michigan, tells practitioners to attest through CAQH once every 90 and 120 days (90 days for five core data elements, 120 days for the rest), and says missed attestation can mean removal from the provider directory, interrupted claim payments or an ended contract (BCBSM provider notice). Other plans set their own rules, so confirm yours.

For the steps a group follows to get every clinician credentialed, see our guide to insurance credentialing for group practices. For the broader picture of why plans and hospitals do this, read why provider credentialing matters.

What privileging is

Privileging is a facility’s decision about which services a specific clinician may perform there. For hospitals in Medicare, the medical staff bylaws must include criteria for determining the privileges granted to individual practitioners and a procedure for applying those criteria to people who request privileges (42 CFR 482.22, current text). It is separate from credentialing. Credentialing says the clinician is qualified. Privileging says what that clinician may do in this building.

A common example is a surgeon who is credentialed by the hospital but is granted privileges only for certain procedures. The facility, not the insurance company, decides this, and it can differ from one hospital to the next for the same clinician.

Where this touches your billing is the site of service. A clinician who performs a procedure at a facility needs that facility’s approval, and the payer needs to know the location. Procedure mix varies by specialty, so see our specialty billing pages for how that shows up in different fields.

What enrollment is

Enrollment is the application to a payer that lets you bill it. For Medicare, that happens in PECOS, the online system for enrolling, updating records, revalidating and managing reassignment of benefits, as described on a Medicare administrative contractor’s enrollment page. Commercial plans and state Medicaid programs run their own enrollment, each with its own forms and portal.

Source: Noridian Healthcare Solutions, Medicare Provider Enrollment Systems (current page, accessed 2026).

The contractor page also warns that updates made in NPPES do not transfer automatically to PECOS, so a changed address has to be updated in both places. For Medicaid specifics, our Medicaid credentialing guide covers the state side.

The effective date is the part that costs money

Approval is not the same as the date you can bill from. For physicians and non-physician practitioners, 42 CFR 424.520(d) sets the effective date of Medicare billing privileges as the later of the date a Medicare contractor receives an application that is later approved, or the date the clinician first began furnishing services at a new practice location (42 CFR 424.520, via Cornell LII, current text). Hold a Medicare claim until you have confirmed the date in writing, because services before that date may not be payable. Commercial plans set their own effective-date rules; ask each one.

The order a practice should follow

There is no single legal order for all three, but a safe working order exists. Credentialing information is the base, because plans and facilities both ask for the same core documents. Enrollment applications often depend on a complete, current profile. Privileging is requested only if the clinician will work at a facility.

1. Get identifiers right. NPI, tax ID, practice address and taxonomy must match across every system.
2. Complete the credentialing profile. Fill in and attest the CAQH profile, then authorize the plans that need to see it.
3. File payer enrollments. Medicare, Medicaid and each commercial plan are separate applications.
4. Record every effective date. Write down the date and who confirmed it.
5. Request facility privileges when needed. Start early, because the medical staff process is its own review.

If you want a deeper view of how enrollment strategy affects revenue, read our payor enrollment strategies post, and the general credentialing guide for the full credentialing workflow.

Mix-ups that cost practices time

Most problems come from using one word for three jobs. These are the patterns that most often cause delays.

• “We are credentialed” treated as “we can bill.” Credentialing with a plan can end in a contract step and an effective date. Billing starts only after both.
• Payers calling enrollment “credentialing.” Plans often use the word for the whole process. Ask whether they mean verification, contracting or both.
• Assuming hospital privileges carry over. Privileges at one hospital do not transfer to another.
• Letting the CAQH attestation lapse. A missed attestation can pause a plan’s review or put a listing at risk.
• Not updating PECOS after a move. NPPES and PECOS do not sync automatically, so a new address can leave records out of step.

Source: RCM Finder working template. Not a regulatory form.

When to get help

Add a clinician, open a second location or change tax ID, and you create three overlapping to-do lists. If nobody in your office has time to run them, outside help can keep dates from slipping. Our credentialing and payer enrollment services cover the profile, the enrollment filings and the date tracking, and our team works with the systems you already use. To see what an unpaid month costs, try the revenue calculator.

Our recommendations

1. Name one owner for dates. We assign one person, not a team, to hold every filed date, approval date and renewal date. Shared ownership is how attestations lapse.
2. Ask every payer what they mean. We ask the plan in writing whether “credentialing” includes contracting and whether an effective date will be issued.
3. Get effective dates in writing. We do not schedule a new clinician for that payer’s patients until the date is confirmed. For Medicare, the rule is in 42 CFR 424.520.
4. Keep identifiers identical everywhere. We compare NPPES, PECOS, CAQH and the payer’s roster. A mismatched address or taxonomy is a common reason for a returned application.
5. Start privileges early. If a clinician needs facility access, we ask the medical staff office for their timeline and required documents before anything else.

Bottom line

Credentialing proves qualifications, privileging sets what a clinician may do at a facility, and enrollment decides when a payer will pay. Track all three per clinician and confirm each date in writing. If you want help doing that, see our credentialing services and medical billing services, or talk to our team.

Frequently asked questions

What is the difference between credentialing and privileging?

Credentialing verifies a clinician’s qualifications, such as licensure and training. Privileging is a facility’s separate decision about which services that clinician may perform there. A hospital’s medical staff handles both, but a clinician can be credentialed by a health plan and hold no hospital privileges at all.

Is payer enrollment the same as credentialing?

No, though payers often use one word for both. Credentialing is the verification of qualifications. Enrollment is the payer accepting you for billing, usually with a contract and an effective date. Ask the payer in writing what its process includes and when you can start billing.

Do I need privileges to bill insurance?

Not as a general rule. Billing depends on enrollment with each payer. Privileges matter if you perform services in a hospital or other facility, because that facility must approve you there. Rules differ by payer, facility type and state, so verify your own situation.

How often does a hospital check the National Practitioner Data Bank?

According to the NPDB’s page for hospitals, a hospital must query when a practitioner applies for medical staff appointment or clinical privileges, including temporary privileges, and every two years after that for practitioners on staff or holding privileges.

How long does enrollment take?

It varies by payer, state and how complete the application is. We do not quote a single timeline because we have not found an official one that covers all payers. Ask each payer for its current processing time and track the filing date yourself.

Which comes first for a new clinician?

Start with accurate identifiers and a complete credentialing profile, then file payer enrollments. Request facility privileges if the clinician will work at a hospital or surgery center. Many payers ask for the same core documents, so one clean set of records speeds every step.

Sources

1. 42 CFR 482.22 – Condition of participation: Medical staff — Cornell LII (eCFR text) (2026)
2. NPDB: Hospitals — HRSA National Practitioner Data Bank (2026)
3. Medicare Provider Enrollment Systems: NPPES, I&A, and PECOS — Noridian Healthcare Solutions (Medicare Administrative Contractor) (2026)
4. 42 CFR 424.520 – Effective date of Medicare billing privileges — Cornell LII (eCFR text) (2026)
5. CAQH Provider Data Portal demo for providers — CAQH (2026)
6. Provider Data Attestation notice — Blue Cross Blue Shield of Michigan (2026)