The Credentialing and Privileging Process: From Application to FPPE

Credentialing and privileging are two different evidentiary questions answered by one sequential process — and most of the audit findings and delayed-start complaints a medical staff office deals with trace back to a step in that sequence being skipped, reordered, or documented informally. This page maps the process end to end: application intake, primary source verification, credentials committee review, medical executive committee recommendation, governing body approval, and the FPPE period that opens the moment a privilege is granted. For the document that records the privileging decision itself, see CASRAI’s delineation of privileges forms guide; this page covers the workflow that produces that document.

Credentialing verifies who; privileging decides what

Credentialing establishes identity and general qualification: is this person who they say they are, and do they hold a valid license, the training they claim, and a clean-enough history to be considered at all. Privileging is the separate, narrower decision that credentialing alone cannot answer: which specific procedures and clinical activities is this practitioner currently competent to perform, at this hospital, right now. A practitioner can clear credentialing completely and still not qualify for every privilege they request — competence for a specific procedure is not implied by a valid license and a clean file.

The federal floor for both sits in the hospital Conditions of Participation. 42 CFR 482.12(a)(6) requires the governing body to ensure selection criteria are based on “individual character, competence, training, experience, and judgment,” and 482.12(a)(7) prohibits granting staff membership or privileges “solely upon certification, fellowship, or membership in a specialty body or society.” 42 CFR 482.22(a)(2) supplies the process itself: the medical staff must “examine the credentials of all eligible candidates for medical staff membership and make recommendations to the governing body on the appointment of these candidates in accordance with State law” — the credentials-committee-to-board pipeline this page walks through is that requirement in practice.

Step 1: Application and self-disclosure

The practitioner submits a completed application — frequently pre-populated from a CAQH ProView or state-uniform-application profile to reduce duplicate data entry across the hospitals and payers a practitioner works with — covering identity, licensure history in every state ever held, education and training, work history with no unexplained gaps, board certification status, malpractice claims history, and self-disclosed adverse actions (license restrictions, privilege actions at other facilities, criminal history, health conditions affecting practice). The application itself is not evidence of anything; it’s the map of what primary source verification then has to independently confirm.

Step 2: Primary source verification

Primary source verification (PSV) means confirming a credential directly with the entity that issued it, or with a designated equivalent source the credentialing program has approved as reliable — not simply accepting a copy the applicant provided. What typically requires PSV in a hospital medical staff file:

• State medical license — verified directly with the issuing state licensing board, including current status and any history of disciplinary action.
• DEA registration — verified where the privilege requested involves prescribing controlled substances.
• Education and training — medical school and residency/fellowship completion verified with the institution or via a recognized verification service.
• Board certification — verified with the certifying board directly, or via an approved verification service, when certification is claimed as supporting evidence (never as the sole basis for a privilege — see 482.12(a)(7) above).
• Malpractice and claims history — verified with the malpractice carrier(s) or a claims-history reporting service.
• National Practitioner Data Bank query — mandatory at initial appointment and privileging for physicians and dentists, and again at least every two years thereafter, under 45 CFR 60.17(a). CASRAI’s NPDB reporting requirements guide covers the query obligation and the reporting side in full, including how continuous enrollment satisfies the periodic-query requirement automatically.
• Exclusion and sanction checks — the OIG List of Excluded Individuals/Entities and the federal SAM.gov exclusion list, checked at initial appointment and re-checked on an ongoing basis, since a Medicare/Medicaid exclusion has billing consequences independent of clinical competence.
• Peer references — typically from practitioners who have directly observed the applicant’s clinical work, addressing current competence rather than general character.

A source that cannot itself be reached directly (a closed training program, a foreign licensing body with no verification channel) is handled through a documented alternate-verification process, not simply waived — the credentials file should show what was attempted and why the alternate method was accepted, not just a blank field.

Step 3: Credentials committee review

Once the file is PSV-complete, a credentials committee — a standing medical staff committee, not the full medical staff — reviews it against the hospital’s bylaws-defined eligibility criteria and the specific privilege criteria for whatever is being requested (see CASRAI’s delineation of privileges forms guide for how those criteria should be written so this review has something concrete to check the file against, rather than a general competence judgment with nothing to point to later). This is the stage where volume thresholds, training pathway requirements, and any outcome-data criteria get checked line by line against what PSV actually turned up, and where a file with a gap, an unexplained lapse, or a threshold not quite met gets flagged for additional information rather than passed forward incomplete.

Step 4: Medical executive committee recommendation

The credentials committee forwards its findings and recommendation to the medical executive committee (MEC), which reviews the file at a higher level — consistency with medical staff bylaws, any input from department chairs on clinical fit, and whether the recommendation appropriately reflects what PSV and committee review actually found. The MEC’s own recommendation is what moves forward to the governing body; it is not itself a credentialing decision.

Step 5: Governing body approval

Final appointment and privileging authority rests with the hospital’s governing body (the board), per 482.22(a)(2) above — the medical staff recommends, the governing body decides. This is not a formality: the governing body is accountable under 482.12(a)(6) for the selection criteria actually being character, competence, training, experience, and judgment, and can decline a recommendation, though in practice this is rare once a file has cleared committee and MEC review cleanly. The approval date is the operative date for the privilege grant and the date FPPE begins.

Temporary and provisional privileges while the file completes

Hospitals commonly grant temporary privileges — for a new practitioner awaiting full committee/board processing, for a locum tenens covering a defined need, or in an emergency — once PSV on the load-bearing elements (current licensure, no active exclusion, no unexplained adverse action) is confirmed, even though the full file hasn’t completed every step above. This is a bridge, not a shortcut around verification: the NPDB Guidebook is explicit that “no distinction is made between temporary clinical privileges… and clinical privileges” for reporting purposes — an adverse action against a temporary privilege is reportable exactly as it would be against a standard one. A hospital that treats temporary privileges as lower-stakes because the paperwork is lighter is not reading that requirement correctly.

FPPE opens the moment a privilege is granted

Governing body approval doesn’t close the file — it opens Focused Professional Practice Evaluation (FPPE), the time-limited, privilege-specific evaluation period that converts “the file said this practitioner met the criteria on paper” into “the hospital observed this practitioner actually perform it competently, here.” Every newly granted privilege triggers FPPE, whether at initial appointment or added later at reappointment. Once FPPE closes out, the privilege moves to Ongoing Professional Practice Evaluation (OPPE) — continuous, lower-intensity monitoring that feeds the next reappointment cycle’s evidence. See CASRAI’s OPPE vs. FPPE comparison for the full mechanics of both, including data sources, the low-volume-practitioner problem, and how the two frameworks satisfy the periodic-appraisal requirement in 482.22(a)(1).

Reappointment: the same process, on a cycle

Credentialing and privileging are not one-time events. Reappointment repeats primary source verification on anything that can change (license status, sanctions, malpractice history, a fresh NPDB query) and re-evaluates each held privilege against accumulated OPPE data and continued volume/currency criteria rather than re-proving competence from a blank slate. A privilege with no supporting OPPE data at reappointment — because the practitioner simply never performed it — is a low-volume problem the reappointment review has to address explicitly, not a reason to renew it unexamined. The cycle length itself is set by each hospital’s own medical staff bylaws, in line with state law and the hospital’s accreditor; see CASRAI’s medical staff bylaws requirements guide for what the bylaws document needs to specify.

Delegated credentialing: CVOs shorten the file, not the accountability

Many hospitals delegate the PSV legwork to a credentials verification organization (CVO) — an internal system-level CVO or an external vendor — under a written delegation agreement, rather than having medical staff office generalists run every verification in-house. Delegating the verification work does not delegate the hospital’s own accountability for the decision: the credentials committee, MEC, and governing body still review and approve based on what the CVO verified, and the delegation agreement needs an oversight mechanism (file audits, a defined reporting cadence) so the hospital isn’t simply trusting the CVO’s output unchecked. This delegation relationship — what to put in the agreement and how to audit it — is its own topic; treat a CVO as a way to make Step 2 more efficient, not as a step you can skip evaluating.

Where this process most commonly breaks down

• Temporary privileges treated as informal — granted without documenting which elements were actually PSV-confirmed before the grant, leaving nothing to show a surveyor if the temporary privilege is ever questioned.
• Credentials committee review that restates the application instead of checking it — a file summary with no record of what specifically was verified, against what criterion, is not evidence of review.
• Recommendations that don’t travel with their basis — the MEC or governing body approving a recommendation without the underlying PSV findings being visible to them, so the ultimate decision-maker under 482.12(a)(6) can’t actually see the evidence their decision rests on.
• Reappointment run as a paperwork renewal — re-verifying licensure and sanctions status is necessary but not sufficient; a reappointment that doesn’t pull in OPPE data for each held privilege isn’t actually re-evaluating competence.
• Delegated CVO output accepted without an audit trail — the hospital remains accountable for the credentialing decision even when a CVO did the verification work.

Frequently asked questions

What’s the difference between credentialing and privileging?

Credentialing verifies identity and general qualifications — license, education, training, board status, work history. Privileging is the separate decision about which specific procedures and clinical activities a practitioner may perform at a particular hospital, based on demonstrated current competence for each one requested.

Who makes the final decision to grant privileges?

The hospital’s governing body (board), per 42 CFR 482.22(a)(2) — the medical staff, through the credentials committee and medical executive committee, examines credentials and recommends; final appointment and privileging authority rests with the governing body.

What does primary source verification actually require?

Confirming a credential directly with the entity that issued it — the licensing board for a license, the training institution for education, the certifying board for board certification — or with a documented, approved equivalent source, rather than accepting a copy the applicant supplied.

Do temporary privileges skip primary source verification?

No. Temporary privileges still require verification of the load-bearing elements (current licensure, absence of exclusion, no unexplained adverse action) before they’re granted, and the NPDB Guidebook treats an adverse action against a temporary privilege exactly the same as one against a standard privilege for reporting purposes.

What happens right after a privilege is granted?

Focused Professional Practice Evaluation (FPPE) opens for that specific privilege — a time-limited period in which the hospital observes actual performance rather than relying on the file alone. Once FPPE closes, the privilege moves to continuous Ongoing Professional Practice Evaluation (OPPE), which then supplies the evidence for the next reappointment cycle.

Does delegating verification to a CVO reduce the hospital’s accountability?

No. A credentials verification organization can perform the primary source verification work under a delegation agreement, but the hospital’s credentials committee, medical executive committee, and governing body remain accountable for the appointment and privileging decision itself, and the delegation agreement should include an audit mechanism rather than unreviewed reliance on the CVO’s output.

For the broader accreditation and survey-readiness picture, see CASRAI’s patient safety pillar, the CMS Conditions of Participation for hospitals guide, and the medical staff bylaws requirements guide.