Provider Enrollment Checklist: 32 Items and When Each Applies

Item 1 — NPI confirmation. Required. Type 1 (individual) for the practitioner, confirmed via NPPES lookup. A Type 2 (organization) NPI is required where an organization is enrolling in its own right — CMS's CMS-855B instructions state that applicants using that form require a Type 2 NPI.

Item 2 — DEA registration certificate. If applicable. This is the item most often stated as universal and is not. Under 21 CFR 1301.11(a), registration is required of persons who manufacture, distribute, dispense, import or export a controlled substance, and 'only persons actually engaged in such activities are required to obtain a registration' (checked 17 September 2026). A physician who does not prescribe, administer or dispense controlled substances does not need a DEA registration, and enrolling one is not a prerequisite to being credentialed. Where a registration does exist, supply the current certificate with its expiration date and the schedules registered.

Item 3 — Social Security Number. Required. Used for individual practitioner identification on the CMS-855I and on most commercial enrollment forms.

Item 4 — Government-issued photo ID. Payer-specific. A driver's licence or passport, requested by some payers and portals to verify identity for online access or notarised signatures, and not requested by others.

Item 5 — Tax Identification Number. Required. SSN for solo practitioners or EIN for groups, carried on the W-9 submitted to each payer.

Items 1, 3 and 5 are the ones with no workaround: a gap in any of them stalls every enrollment at once.

Item 6 — Medical school diploma. Required. A copy of the degree certificate.

Item 7 — Medical school transcript. Payer-specific. Requested by some payers as backup verification; most do not ask.

Item 8 — ECFMG certificate. If applicable. Educational Commission for Foreign Medical Graduates certification, for international medical graduates only.

Item 9 — Residency completion certificate. Required for practitioners who completed a residency, from the accredited program.

Item 10 — Fellowship certificate. If applicable. Where a fellowship was completed, from the accredited program.

Item 11 — Board certification certificate. If applicable. Primary specialty and any subspecialties, with the current expiration date. Board certification is not a universal condition of payer participation; where a plan does require it, or requires board eligibility within a set period, that requirement is in the plan's own credentialing criteria and should be read there rather than assumed.

Most payers verify these through their own primary source verification rather than relying solely on submitted copies, but the copies are normally required as part of the application.

Item 12 — State medical licence. Required. Current, with expiration date and any restrictions noted. For multi-state practices, a licence in each state where the practitioner sees patients — and note that telehealth across state lines is governed by the state where the patient is located, so the licence set follows the patient population, not the office address.

Item 13 — State controlled substance registration. If applicable. Some states require a state-level registration separate from the federal DEA registration; others do not, and a practitioner who does not handle controlled substances needs neither. This is a state-by-state question, checked against the state licensing board.

Item 14 — Board certification status. If applicable. Verified by the payer via the certifying board's primary source, where certification is part of that payer's criteria.

Item 15 — NPDB query. Required, but not by you. The National Practitioner Data Bank query is run by the credentialing entity rather than submitted by the practitioner. What the practitioner supplies is the authorization for the query.

Item 16 — Licence history. Required. Disclosure of any prior or current licence in any state, with action history.

Licensure items are time-sensitive. Payers set their own rules about how much remaining validity an application needs, and several will not verify against a credential that is about to expire — so confirm each payer's current criteria and renew before filing rather than after.

Item 17 — Current malpractice insurance declarations page. Required. Showing carrier, policy number, coverage limits, coverage dates, named insured, and any specialty exclusions.

Item 18 — Claims history. Payer-specific. A history of any claims (open, closed with payment, closed without payment) with dates and disposition. The look-back period is set by the payer's own criteria; ask for the number rather than assuming one.

Item 19 — Tail coverage documentation. If applicable. Where the practitioner has switched carriers, evidence of tail coverage from the prior carrier or prior-acts coverage from the new one, establishing continuous coverage.

Item 20 — Self-insurance documentation. If applicable. Where malpractice is covered through a hospital's self-insurance program rather than a commercial policy. Acceptance of self-insured arrangements varies by payer.

Item 21 — Coverage limits verification. Payer-specific. Minimum per-occurrence and aggregate limits are set by each payer's credentialing criteria, and for some Medicare supplier types by regulation; they are not a single industry number, and surgical, anaesthesia and obstetric specialties are commonly held to higher limits than office-based ones. Take the figure from the payer's current criteria and, where a state sets its own minimum for licensure or for participation in a patient-compensation fund, from the state. Publishing a single national limit here would be inventing a requirement that no one source sets.

Whatever the limits, the declarations page has to be current at the time of credentialing review, and a policy on the edge of expiry is a predictable hold.

Item 22 — W-9. Required. IRS Form W-9 with the current tax ID and the business name as registered with the IRS.

Item 23 — Practice business licence. If applicable. State or local business registration, where the state or locality requires one.

Item 24 — Hospital privileging documents. If applicable. For each hospital where the practitioner holds admitting or surgical privileges, the privileging letter and current status. Practitioners with no hospital privileges supply an explanation of their admitting arrangement instead, which most payers accept.

Item 25 — Lease or property documentation. Payer-specific. Evidence of the right to operate at each practice address. Medicare's site-verification requirements make this more likely to be asked for on the Medicare side than on the commercial side.

Item 26 — Practice phone and fax numbers. Required. The current numbers used for business operations, and the ones that will appear in plan directories.

Item 27 — Bank account information. Required where EFT is being set up. Routing number, account number, and a voided check or bank letter for verification.

Practice information changes more often than credentials do. Keeping it current in one place is what prevents a directory-accuracy problem turning into an enrollment problem.

Item 28 — Disclosure question responses. Required. Criminal history, licence actions, hospital privilege actions, Medicare/Medicaid sanctions and malpractice settlements, each with a written explanation where the answer is yes.

Item 29 — References. Payer-specific. Peer references with name, credentials, and contact information, where the payer asks for them; the number requested varies.

Item 30 — Continuing medical education documentation. If applicable. Requested for some re-credentialing cycles and some specialty enrollments.

Item 31 — Curriculum vitae. Required. A current CV with continuous work history, and an explanation of any gap — payers set their own threshold for what counts as a gap requiring explanation, so check the application before deciding a break is too short to mention.

Item 32 — Attestation signature. Required. The practitioner's signature attesting to the accuracy of everything submitted, notarised where the payer requires it.

The disclosure responses get the closest scrutiny of anything on the list. Any 'yes' needs a written explanation, and an explanation that is incomplete or evasive turns a reviewable answer into a stalled file.

Keeping current versions of all 32 items in one repository, with expiration dates tracked and alerts ahead of expiry, is what turns enrollment from a scramble into a lookup. The repository should also hold version history showing what was previously submitted, because re-credentialing reviews can ask for it.

Most major commercial payers pull primary credentialing data from the practitioner's Provider Data Portal profile rather than from documents you send them, which makes that profile — not your folder — the record those payers actually read. Items the portal does not cover (state-specific Medicaid forms, payer-specific application supplements, hospital-specific privileging documents) should be stored alongside it.

One naming point worth knowing, because stale guides still use the old terms: the profile now sits in the CAQH Provider Data Portal, which replaced the ProView name, and the organisation behind it rebranded from CAQH to DataSpring in 2026. Guides still telling practitioners to 'update ProView' are describing a product name that no longer exists.

The attestation cycle is the part that silently breaks enrollments, and DataSpring publishes it plainly in its Resources FAQ (checked 17 September 2026): practitioners who act on the quarterly email are re-attesting every 90 days, and those who do not follow that schedule are still required to attest every 120 days — every 180 days for Illinois practitioners. A profile not attested within the required timeframe is moved to Expired status, which is what a payer sees when it tries to pull data mid-application.

Build the calendar around those numbers rather than around a generic annual review, and re-check them before relying on them: they are the operator's own published requirement and the operator can change it.