What Happens When Provider Credentials Expire — And How to Make Sure It Never Happens to You

There's a version of this story that plays out in practices across the country every month. A provider's medical license quietly expires. Or a CAQH attestation lapses. Or a malpractice certificate isn't renewed on time. Nothing obvious happens immediately — the practice keeps seeing patients, keeps submitting claims.

Then the denials start coming in.

By the time someone traces the denials back to an expired credential, weeks or months of claims have been affected. Some of those claims can be corrected and resubmitted. Others are permanently unrecoverable. And in the worst cases, the practice has been unknowingly billing under a provider whose credentials weren't current — which creates compliance exposure that goes well beyond the billing department.

Here's exactly what's at stake when credentials expire, and what a functioning credential management system looks like.

What "Credentials" Actually Means

In the context of medical practice billing and compliance, a provider's credentials include everything a payer or hospital needs to verify before authorizing them to practice and bill:

• Medical license — issued by the state medical board, renewed on a state-specific schedule (typically every 2 years)
• DEA registration — required for prescribing controlled substances, renewed every 3 years
• Board certification — specialty-specific, renewed on cycles ranging from 6–10 years depending on the specialty board
• Malpractice insurance — the certificate of insurance (COI) must be current and reflect coverage that meets payer minimums (typically $1M per occurrence / $3M aggregate)
• Hospital privileges — if applicable, renewed on the hospital's credentialing cycle
• CAQH ProView attestation — the centralized provider data profile used by commercial payers, requiring re-attestation every 120 days
• Payer re-credentialing — each payer's formal re-credentialing cycle, typically every 2–3 years

Every single one of these has an expiration date. Every single one can trigger revenue loss and compliance problems if it lapses.

What Happens When a Medical License Expires

A medical license is the legal authorization to practice. Practicing on an expired license — even unknowingly — exposes the provider to:

• License revocation or suspension by the state medical board
• Malpractice insurance voidance (many policies exclude coverage for services rendered under an expired license)
• Payer network suspension or termination upon discovery
• Claim denials retroactive to the expiration date, with limited ability to recover those claims
• Personal liability for services rendered during the lapse period

State medical boards publish license renewal schedules publicly. Most states send renewal reminders — but the provider is responsible for renewal regardless of whether a reminder was received.

The window that catches people: In California, medical licenses are renewed on a two-year cycle. A license expiring in June requires renewal by June 30. A provider who renews on July 3 has technically practiced for three days under an expired license. Depending on the payer and circumstances, that window can create billing problems disproportionate to how small it seems.

What Happens When a CAQH Attestation Lapses

CAQH is less dramatic than a medical license — but arguably more disruptive to billing operations in the short term. Here's why:

Most commercial payers pull provider data from CAQH at multiple points during both initial credentialing and re-credentialing. If a provider's CAQH attestation is expired, the payer cannot pull their data. The credentialing or re-credentialing application stalls — often silently, with no notification to the practice.

Because CAQH requires re-attestation every 120 days, a provider who last attested in February will have a lapsed profile by June. If a re-credentialing application is submitted in July with payers that pull from CAQH, those applications hit an immediate wall.

The problem compounds in busy practices where CAQH maintenance is nobody's defined responsibility. Nobody logs in, nobody re-attests, and the profile quietly expires while applications pile up.

The specific risk: Unlike a license expiration — which has a clear, obvious date — a lapsed CAQH profile creates a hidden obstacle that doesn't announce itself. The first sign is usually an unexplained processing delay weeks into a credentialing application.

What Happens When a Malpractice Certificate Expires

Payers require active malpractice coverage as a condition of network participation. A lapse in coverage — even a single day — is grounds for immediate network suspension.

Malpractice coverage lapses happen most often during:

• Carrier transitions: Switching from one malpractice insurer to another. Even a gap of one day between the old policy ending and the new one beginning is a problem.
• Retirement or career transition: A provider who stops practicing full-time may let their claims-made policy lapse without purchasing tail coverage. This creates both a legal liability and a credentialing problem.
• Administrative failure: The renewal invoice didn't get paid, or the renewal process was delayed without proper bridge coverage in place.

The payer-specific risk: each payer has its own coverage minimums. A policy with $1M/$3M coverage may be accepted by Blue Shield but rejected by Anthem if their minimum is $2M/$6M. When switching carriers or renewing, verify that new coverage meets each payer's specific requirements.

What Happens When DEA Registration Expires

DEA registration expires every three years and is required for any provider who prescribes controlled substances. For primary care physicians, psychiatrists, pain management specialists, and any practice where controlled substance prescribing is a meaningful part of clinical practice, an expired DEA creates immediate problems:

• Legal prohibition on prescribing controlled substances in Schedules II–V
• Payer-specific billing implications for certain procedures and medications that require DEA documentation
• Hospital privileges implications at facilities that verify DEA as part of privileging
• Credentialing applications that include DEA documentation — if the certificate is expired, the application is incomplete

The DEA renewal portal sends email reminders, but three years is a long interval. In a practice that has turned over administrative staff, the original registration email may be long gone and the renewal reminder may land somewhere nobody monitors.

Building a Credential Expiration Tracking System

The solution to all of these problems is the same: a centralized, current record of every credential for every provider, with automated reminders at 120, 90, and 60 days before each expiration.

At minimum, your system should track:

Credential	Who	Expiration Date	Reminder At
Medical license	Each provider	State board renewal date	90 days
DEA registration	Each prescribing provider	3-year anniversary	90 days
Board certification	Each provider	Specialty board renewal	120 days
Malpractice COI	Each provider + group	Policy expiration	90 days
CAQH attestation	Each provider	Every 120 days	90 days
Payer re-credentialing	Each provider × each payer	Per payer schedule	120 days
Hospital privileges	Each provider × each facility	Per facility cycle	120 days

For a solo practice with one provider and 10 payers, this is manageable with a spreadsheet. For a group practice with 5 providers and 15 payers, you're tracking 75+ re-credentialing deadlines alone — plus licenses, DEA, and malpractice for each provider. At that scale, a spreadsheet becomes error-prone and a dedicated credentialing management system (or credentialing partner) becomes worth the cost.

What to Do If Something Has Already Lapsed

If you discover a credential has expired:

1. Renew immediately — don't wait to assess the damage first. Stop the bleeding.
2. Update CAQH — once renewed, update the credential in your CAQH profile and re-attest.
3. Notify each payer — proactively send the updated credential to each payer's credentialing department with a cover note explaining the lapse was administrative and has been corrected.
4. Audit your recent claims — identify the date range during which the credential was lapsed, pull all claims submitted during that period, and assess which payers may have processed claims against an expired credential.
5. Consult with your billing team — they can tell you whether any payer has already flagged the issue and whether claim corrections or reinstatement applications are needed.

The faster you move, the less revenue is at risk.

---

Not sure where your provider credentials stand right now? Talk to our team — we'll audit every credential across every provider in your practice, flag anything expiring in the next 120 days, and tell you exactly what needs action.