General operational information only. Payer, state, contractual and regulatory requirements vary. Confirm current requirements with the applicable payer or agency.
Quick answer
What practice leaders need to know
CAQH maintenance is ongoing, not a one-time credentialing task. Keep licenses, malpractice coverage, locations, work history and authorizations current, complete required attestations, and retain confirmation that participating payers can access the record.
Treat CAQH as a maintained provider record
CAQH Provider Data Portal is commonly used to collect and share professional information with participating organizations that a provider authorizes. Creating the profile is only the beginning. The information must remain accurate as licenses, insurance, addresses, affiliations, work history and contact details change. A payer may use the record during an initial application, recredentialing or another verification process, but the payer still controls its own decisions and requirements. Build maintenance into routine credentialing operations instead of reopening the profile only after a payer reports a problem. The practice should know who can update the record, who approves changes and where supporting evidence is retained.
Understand what attestation confirms
Attestation is the provider's confirmation that the information in the profile is complete and accurate at that time. It should follow a meaningful review rather than an automatic click. Compare names, identifiers, addresses, specialties, education, work history, hospital affiliations, disclosures, licenses and insurance with current source records. Resolve incomplete sections and replace changed documents before attesting. Record the attestation date and confirmation and plan the next review using the current portal requirements. An attested profile can still contain an error if the underlying information was not checked, so attestation should be treated as a control point—not proof that every connected payer record is correct.
Create one verified source of provider information
Maintain an approved provider file outside any single payer portal. It should identify the legal name, individual NPI, taxonomy, license information, education, training, work history, malpractice coverage, service and mailing addresses, practice affiliations and authorized contacts. Record the source, last verification date and owner for each field. Use that file when updating CAQH and other systems so staff do not copy an outdated portal value into another application. When a discrepancy is found, determine which record is authoritative, correct the source and then update every affected system. This approach reduces explanations that differ from payer to payer and creates a defensible history of what changed and why.
Monitor every time-sensitive document
Licenses, malpractice insurance, controlled-substance registrations and other credentials may renew on different schedules. Build a calendar with the expiration date, renewal owner, lead time, evidence requirement and affected provider and payer records. Request updated documents early enough to review them before the current version expires. Upload clear, complete files and verify that the profile dates match the document. Retain the prior version according to the practice's record policy so the team can answer questions about historical coverage. A portal reminder is helpful, but it should not be the only control; email ownership changes, filters fail and notices may not cover every related payer obligation.
Keep provider-controlled access accountable
The provider remains responsible for the accuracy of the profile and should understand which individuals can enter, review or approve information. Use named accounts and the portal's supported delegation features rather than sharing passwords. Apply multifactor authentication when available, remove access when responsibilities change and maintain a backup contact who can preserve continuity. Administrative staff may prepare information, but material disclosures and attestations should follow an approved provider review process. Never ask a provider to send portal passwords through ordinary email or a public website form. Document the access model so a departing employee does not become the only person who knows how the profile is maintained.
Coordinate address and affiliation changes
A provider may have a home, mailing, correspondence and one or more service addresses, and the way they are requested varies by system. Confirm the purpose and privacy implications of each field before updating it. When a provider joins or leaves a group, changes locations or adds a practice, identify the CAQH sections and all payer affiliations affected. Preserve effective dates and do not remove historical information merely to make the profile look simpler when the portal or payer requires a complete history. Group participation, reassignment, roster acceptance and directory updates may need separate payer actions even after the CAQH profile reflects the new affiliation.
Reconcile CAQH with NPPES and PECOS
CAQH, NPPES and PECOS serve different purposes. NPPES issues and maintains NPI-related data, while PECOS supports Medicare provider and supplier enrollment. Updating one does not automatically update the others or commercial payer records. Compare legal names, taxonomy, addresses, contact information and organizational relationships where the same facts appear, while respecting each system's field definitions. Submit changes through each required channel and retain confirmation. Do not mark the project complete when CAQH is correct if an outdated Medicare, Medicaid, NPPES or payer record still affects claims, directories or revalidation. The maintenance tracker should list every connected system and its individual status.
Respond to payer recredentialing requests
A current CAQH record can make information easier to retrieve, but it does not replace payer-specific recredentialing steps. Monitor correspondence and portals for notices, deadlines, supplemental forms and requests for clarification. Confirm the payer, provider, entity, network product and submission method before responding. If the payer requests information that conflicts with the profile, investigate and correct the underlying source rather than creating a one-off answer. Record submission evidence, the payer's reference number, open dependency and next follow-up date. Escalate approaching deadlines and unanswered requests because loss or interruption of participation can affect scheduling, patient communication and revenue operations.
Build event-driven maintenance triggers
Do not wait for the next scheduled attestation to update a material change. Create triggers for license or malpractice renewal, name change, address change, new group affiliation, employment change, specialty or taxonomy change, adverse disclosure, leave, retirement and changes to authorized contacts. For every trigger, define who reports it, who validates it and which systems must be reviewed. A provider onboarding and offboarding checklist should include CAQH alongside NPPES, PECOS, Medicaid, payer and directory actions. Event-driven controls reduce the period when a profile is technically attested but no longer reflects current practice operations.
Audit the record before major applications
Before submitting a new payer application or responding to a recredentialing cycle, perform a structured comparison between CAQH, the provider source file and the target payer's requirements. Check profile completeness, attestation status, document dates, work-history gaps, current locations, malpractice limits, disclosures and data-sharing authorization. Confirm that uploaded files are readable and apply to the correct provider. Use a reviewer who did not enter every field when feasible, because a second set of eyes may catch transposed dates or stale affiliations. Record the review date and exceptions so the team can show what was validated before the application relied on the profile.
Use a maintenance dashboard with evidence
A useful dashboard shows each provider's next attestation, document expirations, pending updates, authorized organizations, related payer deadlines, owner and evidence link. Use statuses such as verified, update required, submitted, pending provider review and blocked rather than a vague complete label. Review exceptions regularly and alert leadership when a missing provider response or expired document threatens an application or participation deadline. Measure timely completion and repeated error types, not only the number of profiles touched. The purpose of the dashboard is to direct action and protect continuity, not to replace the source documents or portal confirmation.
Handle disclosures and work history carefully
Professional history and disclosure questions require complete, accurate provider input. Use the portal's current definitions and request clarification from the provider when dates, gaps or an answer are uncertain. Do not guess, omit an event to speed submission or copy another application's wording without confirming it remains correct. When an explanation or supporting record is required, retain the approved version and make sure related payer responses remain consistent. Sensitive information should be accessible only to personnel with a legitimate role. Material questions may require guidance from qualified credentialing, legal or compliance professionals before the provider attests.
Create a repeatable provider review meeting
For practices with several clinicians, schedule a short, structured review before each attestation or major payer cycle. Present only the fields and documents that need provider confirmation, along with unresolved discrepancies and approaching expirations. Record decisions, assign actions and send the provider a completion summary. This reduces long email chains and helps clinicians focus on facts only they can validate. The credentialing team should prepare evidence in advance and avoid asking the provider to navigate every administrative detail. A repeatable review cadence makes timely attestation more reliable without reducing the provider's responsibility for accuracy.
Working reference
CAQH maintenance calendar
Use current CAQH prompts and payer rules to confirm exact requirements.
| Trigger | CAQH action | Connected review |
|---|---|---|
| Attestation due | Review all sections and attest | Confirm payer authorization and evidence |
| License renewed | Upload and update dates | Review payer and state records |
| Malpractice changed | Replace certificate and policy details | Confirm payer notification needs |
| Address changed | Update applicable locations | Review NPPES, PECOS, Medicaid and directories |
| New group affiliation | Update applicable practice relationships | Complete payer affiliation actions |
Common questions
Questions practice teams ask
Does CAQH approve credentialing?
No. CAQH shares authorized data, while each payer controls credentialing and participation.
Does attestation replace document updates?
No. Replace changed or expiring documents before attesting.
Will CAQH update PECOS?
No. PECOS is a separate Medicare enrollment system.
Who should receive reminders?
Use a monitored primary contact and a documented backup.
What proof should be retained?
Keep attestation confirmation, document versions, payer authorizations and related submission evidence.
Primary references
Sources and further reading
Requirements can change. Use these primary sources to confirm the current rule that applies to the payer, service and date of care.
Ready to turn this guidance into action?
Tell us what is happening in your practice, and we will help you identify the most useful next step.