The Verification Gap

The regulatory clock

Three separate regulatory timelines are converging inside an eighteen month window, and each carries a date that a specific person inside a facility already owns. The detail sits in the table above.

• —The three dates most facilities can name if asked: next accreditation survey or delegation audit, next PECOS revalidation, next provider start date or site opening.
• —The cross-program termination rule is the least discussed and the most dangerous. It means an organization can be billing under an excluded provider because of an action taken in a state it does not operate in.
• —Directory accuracy becomes publicly visible in 2027 via Medicare Plan Finder, which converts a compliance problem into a competitive and reputational one.

The identity problem is no longer theoretical

The premise underneath all credentialing is that the person is who they claim to be and holds what they claim to hold.

Federal enforcement over the last three years has repeatedly demonstrated that this premise fails, at scale, and that the failure is not detected by the systems designed to catch it.

The Department of Justice’s 2025 National Health Care Fraud Takedown — the largest in US history — charged 324 defendants, including 96 doctors, nurse practitioners, pharmacists and other licensed medical professionals, across 50 federal districts, in schemes involving more than $14.6 billion in alleged fraud. Identity misuse runs directly through the case list.

• —Impersonation of a licensed physician — using a real provider’s name, NPI and state license number to sign federal medical certifications.
• —Multi-year schemes to impersonate a licensed registered nurse across several healthcare agencies.
• —Aggravated identity theft using advanced practice nurses’ NPI numbers without their knowledge.

Separately, Operation Nightingale — the HHS Office of Inspector General’s investigation into fraudulent nursing diplomas sold through several Florida schools — accounted for more than 7,600 fraudulent diplomas and transcripts. Twelve further defendants were charged in the September 2025 Phase II, on top of the twenty-five charged in the original action, and state boards continue to issue revocations to nurses who already passed the NCLEX and obtained licensure.

• —The NPI is an identifier, not an authenticator. It was never designed to bind a credential to a verified human being.
• —DOJ and CMS have both shifted toward pre-payment, data-driven detection, which compresses the time between anomalous data and enforcement action.
• —The exposure for a facility is not only the fraudulent provider. It is every claim submitted under that provider, every certification they signed, and every patient they touched.

The financial cost is already quantified

The revenue consequence of credentialing delay is well documented and no longer contested.

One in five hospitals able to quantify the impact report losses exceeding $1 million a year. Delay of that kind is at least visible while it happens.

• —An analysis across 190 specialty practices found that 61% carry at least one active credentialing lapse at any given moment.
• —Multi-location enrollment updates fail at a rate roughly 34% higher than single-location updates.
• —For any organization adding sites, acquiring practices or expanding service lines, growth itself increases the probability of an undetected lapse.

The data itself is fragmented by design

The reason this is hard is not that credentialing teams are careless.

It is that no organization holds a complete, current picture of any provider, because provider data is distributed across parties who each maintain a partial and separately maintained copy.

• —Providers re-enter the same information dozens of times per year, which is itself a source of error and staleness.
• —Payers report the structural failure sits in roster ingestion: files arriving in varying formats and timing, where without automated normalization and NPI matching, errors compound rather than correct.

The workforce stopped being static

The periodic model assumed a stable medical staff. That assumption is gone.

• —The unit of credentialing is no longer a provider joining an organization. It is a provider moving continuously among organizations, states and payers.
• —Every move regenerates the entire verification burden from zero, for every party involved.
• —Higher mobility plus higher turnover means the average file is stale more often, for longer, across more organizations simultaneously.

The liability layer

Underneath the compliance and revenue arguments sits the exposure that reaches the board.

Negligent credentialing is a recognized theory of direct institutional liability in a substantial number of states, distinct from vicarious liability for a physician’s conduct. Courts have found organizations liable on two grounds: the organization had an adequate process and failed to follow it, or it followed its process and the process itself was inadequate. Both are decided years after the fact, on the evidence in the file.

In a recent action described by Brewster and De Angelis involving a physician alleged to have lacked proof of current clinical competence for a specific procedure, necessary documents were found missing during discovery.

• —Classification does not insulate the organization. Courts have extended the duty to independent contractors granted privileges.
• —Peer review privilege is narrower than commonly assumed. Where a claim is brought directly against the entity, credentialing and recredentialing records can become discoverable.