Delegated Credentialing: How It Works and What Groups Must Track

Published November 2, 2026

TL;DR

  • Delegated credentialing is an arrangement in which a health plan hands specific credentialing and recredentialing work to a provider organization or credentials verification organization (CVO), under a written agreement, while the plan stays accountable.
  • Plans may require NCQA Credentialing Accreditation or Certification, a pre-delegation audit, or both before they will delegate. Requirements vary by plan and by state.
  • The agreement spells out who does what, the reports owed (one published payer template requires monthly roster updates plus quarterly summaries), annual file audits, and how the plan can revoke delegation.
  • Federal rules for Medicare Advantage (42 CFR 422.504(i)) and Medicaid managed care (42 CFR 438.230) let plans delegate but keep them ultimately responsible. Medicare Advantage rules require recredentialing at least every 3 years, and some delegation agreements set a 36-month limit.
  • Your committee's approval is not the same as the payer having the provider loaded. Roster submissions, effective dates, system loading and directory listings still need tracking.

Picture a credentialing committee that approves a new nurse practitioner on the 3rd of the month. Under a delegation agreement, that approval stands in for the plan's own credentialing review, so the group does not send the plan a separate credentialing application. Now suppose that six weeks later her claims are still rejecting and she is missing from the plan's online directory. In a case like this, nothing went wrong with the credentialing; what slipped is the work that sits between a delegated approval and a provider who is actually live in the payer's systems.

That gap is the part of delegated credentialing most explainers skip. Below is how delegation works, what the rules require, and the tracking that remains your job after the agreement is signed.

What delegated credentialing is

In a standard arrangement, each health plan credentials every practitioner who joins its network: it collects the application, verifies licensure and other credentials with primary sources, and makes a decision through its own committee. Under delegation, the plan assigns some or all of those activities to another organization. That might be a large medical group, a hospital system, an MSO or a CVO.

Payer documents describe the same core idea. Excellus BlueCross BlueShield's credentialing policy says the delegated entity "will perform specified activities on behalf of the Plan as set forth in an agreement," while "Accountability for those activities shall remain with the Plan." Sunshine Health's published delegation attachment has the provider organization "accept assignment of responsibility for the credentialing and recredentialing" of the practitioners listed in the agreement.

Delegated credentialing is a different subject from delegated utilization management, where a plan hands prior authorization review to another entity. That arrangement is covered in our guide to delegated utilization management.

Who can be delegated

There is no single national eligibility test. Each plan sets its own bar, and state Medicaid programs can add their own. Three patterns show up in the plan and state documents reviewed here.

NCQA accreditation or certification. NCQA runs two credentialing tracks. Credentialing Accreditation covers organizations providing full-scope credentialing services, including committee review of practitioners. Credentialing Certification covers organizations that verify practitioner credentials. Some plans make one of these a precondition: Excellus's policy states it "will not consider a delegated credentialing arrangement unless the Delegated Entity is accredited or certified in Credentialing, by NCQA."

A pre-delegation audit. Plans generally assess an organization's capacity before handing over the work. Sunshine Health's attachment is "contingent upon the successful completion and approval of the delegation audit," and its oversight plan describes a desk audit or on-site visit that can include program descriptions, committee minutes and policies. Excellus's policy describes a pre-delegation site visit or desk audit, though it also says pre-delegation audits are not required when it delegates to NCQA-accredited or certified organizations.

Size and location criteria (state agency example). In Ohio, the state Medicaid agency itself credentials Medicaid providers under Ohio Admin. Code 5160-1-42, and the companion rule on delegated credentialing, 5160-1-42.1 (effective January 1, 2023), lets the Ohio Department of Medicaid (ODM), not a managed care plan, authorize eligible provider delegates. Applicants must, among other things, be based in Ohio or a contiguous state, have at least fifty Ohio Medicaid-enrolled and active affiliated individual providers, and complete a pre-delegation audit conducted by ODM that reviews credentialing policies, a sample of practitioner files, committee minutes and ongoing sanctions monitoring. The rule also says delegated credentialing of facilities is not permitted under the ODM agreement. Other states and plans set different terms, so treat Ohio as one example of a state agency's criteria rather than a template for plan delegation.

What goes into a delegation agreement

Federal rules set a floor for what the contract must say in Medicare Advantage and Medicaid managed care (covered below). Payer templates then add operational detail. Based on the published Excellus policy and Sunshine Health attachment, expect the agreement to address:

  • Scope. Which practitioner types, and sometimes which facilities, the delegate credentials. Sunshine's template lists physicians, allied health professionals and mid-level practitioners, and carves out practitioners such as those who practice exclusively in inpatient settings and covering locum tenens.
  • Division of tasks. Excellus requires the agreement to state which entity accepts applications and attestations, collects data from NCQA-approved sources, conducts site visits, evaluates ongoing monitoring information and makes credentialing decisions.
  • Reporting. Excellus requires at least semi-annual reporting. Sunshine's template requires monthly roster updates and quarterly comprehensive rosters and activity summaries.
  • Oversight and audits. How the plan will review files and policies, and how often.
  • Remedies. Corrective action plans, additional audits and revocation if the delegate falls short.
  • Plan decision rights. Both payer documents keep the plan's right to approve, suspend or terminate individual practitioners.
  • Sub-delegation. Whether the delegate may hand work to a third party. Sunshine requires written requests at least 60 days in advance and plan approval.
  • Termination. Sunshine's template lets either party end the attachment without cause on 120 days' written notice.

How plans oversee delegated credentialing

Delegation shifts the work, not the oversight. Both payer documents reviewed here call for annual audits of the delegate, with regular reports in between.

Excellus's policy describes an annual visit or audit that reviews a minimum of 40 or up to 5% of the delegate's credentials files, whichever is less, plus policies, procedures, staffing and organizational charts. Sunshine Health's oversight plan calls for an annual comprehensive review by desk audit or on-site visit, including random samples of credentialing and recredentialing files. If findings show noncompliance, a corrective action plan follows.

Sunshine also attaches performance thresholds. Its template requires 95% compliance on critical elements, including no more than 90 days from application receipt to committee approval for initial credentialing, recredentialing within 36 months of the previous credentialing date, and on-time reports. Failure to meet compliance requirements results in a corrective action plan, and failing that plan can lead to probation, suspension or termination of delegation. Thresholds like these are plan-specific, so read your own agreement rather than assuming these numbers apply.

The regulatory basis

NCQA standards. Payer contracts tie delegated work to NCQA's credentialing ("CR") standards. Sunshine's attachment requires delegated policies to follow "the most current NCQA Health Plan (HP) Standards & Guidelines," and its responsibilities matrix cites CR elements for policies, primary source verification, ongoing monitoring and sub-delegation (CR 8). NCQA sells the full standards and guidelines through its store, so a plan's delegation agreement is often the most practical way to see which elements it expects you to meet.

Medicare Advantage. Under 42 CFR 422.504(i), an MA organization "maintains ultimate responsibility" for its CMS contract regardless of its relationships with downstream entities. If it delegates activities, each contract must specify the delegated activities and reporting responsibilities, provide for revocation or other remedies, and specify that performance is monitored on an ongoing basis. For credentialing specifically, the contract must specify that either the MA organization reviews the credentials of affiliated medical professionals, or it reviews and approves the credentialing process and audits it on an ongoing basis. The underlying credentialing standards, including recredentialing at least every 3 years, sit in 42 CFR 422.204.

Medicaid managed care. Under 42 CFR 438.214, each state must establish a uniform credentialing and recredentialing policy that its MCOs, PIHPs and PAHPs follow, and each plan must follow a documented credentialing process. Under 42 CFR 438.230, a plan that delegates keeps ultimate responsibility for its state contract, and the written agreement must specify the delegated activities and reporting, provide for revocation or other remedies, and grant the state, CMS and others audit rights that run through 10 years from the end of the contract period or the completion of any audit, whichever is later. Because 438.214 also requires plans to comply with additional state requirements, Medicaid delegation terms can differ from state to state.

The recredentialing cycle

Delegation covers recredentialing as well as initial credentialing, and in the documents reviewed here the clock is 36 months. Federal MA rules require recredentialing "at least every 3 years," and Sunshine Health's delegation matrix requires a recredentialing decision "no more than 36 months after the previous decision." Between cycles, delegates are often responsible for ongoing monitoring too. Sunshine's matrix, for example, calls for monitoring license sanctions and Medicare and Medicaid sanctions monthly or within 30 days of a sanction report's release.

Practitioner-side data upkeep keeps running in parallel. If your providers' application data lives in CAQH, the profile maintenance and re-attestation cadence still matters for payers outside your delegation agreements.

What still has to be tracked after delegation

This is the part of delegation that stays on your desk. A delegated approval ends the credentialing step. It does not by itself put the provider into the payer's claims system or directory.

Roster submissions and deadlines. The roster is how the payer learns what you decided. Sunshine's template requires monthly roster updates and quarterly comprehensive rosters. Initially credentialed and decredentialed providers, and providers denied at recredentialing, must be reported within 15 calendar days, and suspensions or decredentialing for cause within three business days. A late or rejected roster leaves the payer unaware of an approval.

Payer loading into systems. Sunshine's template routes credentialing reports both to its credentialing department and to its provider and contracting department "for enrollment into systems." Two departments handle the same data, so a provider can be credentialed and still not be loaded. Confirm the load with the payer rather than inferring it from the committee date.

Effective dates. Track the date the payer actually makes the provider effective, by plan and product, not just your committee approval date. Billing against an assumed date invites denials.

Directory data. Roster fields often feed the directory directly. Sunshine's layout marks fields such as location name, service address, phone number and office hours as data that "will display in the provider directory." Keeping those fields accurate is an ongoing job, as our piece on provider directory accuracy and attestation explains.

Medicaid enrollment. Delegated credentialing does not replace state Medicaid enrollment. Under 42 CFR 438.602(b), the state must screen and enroll all network providers of its managed care plans. Plans may execute provider agreements while that is pending for up to 120 days, but must terminate the provider if the state says it cannot enroll them or one 120-day period passes without enrollment.

Plan decisions. The plan keeps the final say. Sunshine's attachment reserves the plan's right "to approve, suspend, or terminate" any credentialed provider, so a delegated approval can still be overridden.

In practice, this follow-up looks a lot like non-delegated provider enrollment follow-up: reference numbers, effective dates and the payer's own confirmation. SuperDial's credentialing and enrollment workflow handles the payer-side status calls (application and enrollment status, effective dates, missing items and directory data) and returns structured results.

Pros and cons of delegation

AdvantagesTrade-offs
SpeedYour committee's decision stands in for separate credentialing reviews at each delegating planPayer loading still runs on the payer's timeline
ControlYour group sets intake, verification and committee timingYou must meet each plan's policies, which can differ
WorkloadFewer duplicate applications to plansRosters, reports, annual audits and corrective actions per plan
RiskCredentialing quality is in your handsPoor audit results can mean corrective action plans or revoked delegation
EligibilityAvailable to organizations that meet plan criteriaOften requires NCQA accreditation or certification, or a pre-delegation audit

Deciding whether delegation fits your organization

Delegation tends to fit organizations that already run a disciplined credentialing committee, onboard providers at a steady volume and can staff reporting across several plans at once. If you are adding a handful of providers a year, the audit preparation and per-plan reporting may cost more than the applications you avoid.

Before pursuing it, check three things. Can you meet the eligibility bar each target plan sets, whether NCQA status, a pre-delegation audit or a state's size threshold? Do you have the systems to produce clean monthly rosters in each plan's format? And who will confirm, plan by plan, that each approved provider is actually loaded and effective? If that last question has no owner, delegation can move credentialing faster while billing still waits.

FAQ

Is delegated credentialing the same as using a CVO?

Not necessarily. A CVO is an organization that verifies practitioner credentials, and NCQA certifies CVOs through a separate track from full-scope Credentialing Accreditation. Delegated credentialing is the formal arrangement in which a plan assigns credentialing activities to another entity under a written agreement with oversight. A CVO can be that delegate, or a sub-delegate of a provider group where the plan's terms allow it; Sunshine Health's template, for example, requires the plan's advance approval for any sub-delegation.

Do I still need to be enrolled with Medicaid if a plan delegates credentialing to my group?

Generally yes. Under 42 CFR 438.602(b), states must screen and enroll all network providers of Medicaid managed care plans, so delegated credentialing with a plan does not substitute for state enrollment.

Can a health plan reject a provider my committee approved?

Yes. Both payer delegation documents reviewed here reserve the plan's right to approve, suspend or terminate individual practitioners. Federal MA rules add that if an MA organization delegates provider selection, the contract must state that it retains the right to approve, suspend or terminate the arrangement.

What happens to credentialed providers if delegation ends?

It depends on the agreement. Sunshine Health's template says providers credentialed by the delegate remain credentialed until recredentialing is due, at which point the plan takes over the function.

Sources

Run a pilot on a real workflow.

Bring a representative batch, define the output schema, and validate ROI with your payer mix in 30 to 90 days.

Book a Demo
Superdial white logo
The communication layer for revenue cycle teams.
Workflows
Benefits Verification
Prior Authorization
Claim Status
Credentialing & Enrollment
Provider Data Management
Who We Serve
RCM Companies
Provider Groups
Orthopedics
Gastroenterology
Dental & DSOs
Health Systems
Payers
Digital Health
Pharma
Company
Case Studies
Newsroom
Security
Blog
API Docs
Book a Demo
Careers