The real question: build, buy, or outsource provider credentialing?

There are three real paths for a multi-location provider group handling credentialing and payer enrollment, and most practice administrators only ever evaluate one of them. You can buy a seat-based platform like symplr, MedTrainer, or HealthStream's CredentialStream and run the process in-house with your own staff. You can outsource the whole workflow to a credentialing BPO like Credex Healthcare or MedCycle Solutions and let someone else chase the paperwork. Or you can build (or augment an existing tool with) AI agents that do primary source verification and payer portal data entry directly, keeping the process, the data, and the institutional knowledge inside your organization. Each one is right at a different headcount, a different growth trajectory, and a different risk tolerance. None of them is right by default, and the vendor landscape (understandably) won't tell you that.

This decision is showing up more often because of two forces at once: PE-backed roll-ups adding locations and providers faster than credentialing teams can absorb, and payer revalidation cycles that never stop, since CAQH re-attestation alone comes due every 120 days per provider. If you're a Credentialing Director or MSO COO staring at a backlog, the question isn't "which vendor has the best reviews." It's which of these three operating models fits the shape of your organization right now, and which one you'll outgrow in eighteen months.

What provider credentialing and payer enrollment actually involve

Credentialing and enrollment are a document-verification-and-portal-entry problem, not a database problem, and that distinction explains why so many tools underdeliver. Primary source verification (PSV) means confirming a provider's license, education, board certification, malpractice history, and sanctions status directly with the issuing body, not just collecting a scanned copy. Most commercial payers require the provider's data to live in CAQH ProView first (CAQH's credentialing solution is the closest thing the industry has to a shared clearinghouse). From there, enrollment means getting that provider into PECOS for Medicare (the official process is documented by CMS), into state Medicaid systems, into the National Practitioner Data Bank for sanctions checks, and then individually into every commercial payer's own portal, each with its own login, its own required fields, and its own quirks. A mid-sized group might be enrolling one provider across 40 to 60 separate payer relationships.

None of that is hard in the sense of being technically complex. It's hard because it's repetitive, deadline-driven, spread across systems that don't talk to each other, and unforgiving of small errors (a wrong NPI digit or an expired license upload can silently stall an application for weeks). NCQA's accreditation standards exist precisely because this process needs structure, not improvisation (NCQA's credentialing standards are what most health plans and CVOs are held to, directly or indirectly). Any tool or team you bring in has to satisfy that structure while actually getting through the portal work, and that second part is where most solutions quietly fall short.

Is provider enrollment the same as credentialing?

No, and conflating them is the single most common mistake we see in RFPs and internal process docs. Credentialing is the verification step: confirming a provider is who they say they are and holds the licenses and qualifications they claim, typically against NCQA standards. Enrollment is the administrative step that follows: getting that already-credentialed provider set up to bill specific payers, including Medicare, Medicaid, and each commercial plan. A provider can be fully credentialed and still unable to generate revenue because enrollment with a specific payer hasn't cleared. Groups that treat these as one undifferentiated task tend to track the wrong metrics, measuring "credentialing turnaround" when the real revenue blocker is sitting in enrollment queues for three or four specific payers.

What credentialing delays actually cost

Delays here aren't an administrative inconvenience, they're direct revenue loss, because a provider who hasn't cleared enrollment can't bill for the care they're already delivering. The Association for Advancing Physician and Provider Recruitment notes that credentialing is "typically told 60 days" to new hires and leadership, but in some states the real process runs six months or more once PSV, board verification, and payer-specific requirements stack up. Every one of those extra days is a provider on payroll who isn't generating billable revenue, which is why MedTrainer frames credentialing timelines directly in terms of per-day cost to the organization (MedTrainer's credentialing pricing breakdown).

The direct cost side isn't small either. Credentialing.org puts the average direct cost to credential a physician in the US at $2,000 to $5,000 per provider (credentialing.org's 2026 cost data), and re-credentialing, which happens on a recurring cycle for every provider you employ, runs 50 to 60% of that initial cost each time. Run the arithmetic on a 150-provider group: even at the low end, $2,000 per provider for initial credentialing is $300,000 in direct cost before you've factored in a single day of enrollment delay. Add CAQH's mandatory 120-day re-attestation cycle across the same roster, and you have a process that never actually finishes. It just rotates.

Why seat-based credentialing software still needs a human running it

Buying symplr, MedTrainer, or HealthStream's CredentialStream gets you a system of record, not a system that does the work. These platforms are genuinely good at tracking expirations, storing documents, and giving you a dashboard. What they don't do is log into each of the 40-plus individual payer portals and move an application forward, because that work still requires a person checking payer-specific portals, re-entering the same provider data in slightly different formats, and following up on stalled applications. Google's own AI Overview for "medical credentialing software" already surfaces user sentiment on this: configured well, these tools are powerful, but they require heavy backend setup and a dedicated internal expert to actually run them day to day. That's not a knock on the vendors. It's an honest description of what a seat-based license actually buys you.

The practical failure mode we see is a group that buys the platform expecting it to solve the backlog, then discovers six months later that the backlog moved from "untracked" to "tracked but still stuck," because nobody budgeted for the person (or team) needed to drive 40 payer portals to completion. The software didn't fail. The buying decision assumed the wrong problem was being solved.

Why outsourcing to a credentialing BPO trades one bottleneck for a data-custody risk

Outsourcing solves the labor problem and creates a different one: a third party now holds your providers' Social Security numbers, NPIs, DEA numbers, and license data, often with retention and subcontracting terms that aren't fully visible to you. For a group that's credentialing 15 or 20 providers a year, a BPO is often the right call, since the fixed internal cost of building expertise doesn't pencil out at that volume. The problem shows up at scale. BPO pricing is typically structured per provider, per month, for ongoing enrollment maintenance on top of initial setup fees, and that cost scales linearly with headcount in a way that in-house capability doesn't. A group paying $150 per provider per month across 200 providers is carrying $360,000 a year in ongoing fees alone, a number that keeps climbing every time the group acquires another location.

There's also a visibility problem. When a payer application stalls inside a BPO's process, you're often finding out from a status email rather than a live dashboard, and your credentialing director is managing the relationship rather than the work. For groups handling protected health information and sensitive identity data across multiple states, that loss of direct control is worth weighing against the labor savings, especially once you're past the scale where a BPO's per-provider fee is genuinely cheaper than running the process yourself. This is the same tension we've written about for healthcare operations more broadly in our piece on building versus buying denial management, and any vendor touching this kind of data should be able to answer the questions we lay out in what HIPAA-compliant AI actually requires beyond a signed BAA.

When building or augmenting with AI agents actually pays off

Custom automation starts winning once you're credentialing and re-credentialing enough providers that the per-provider BPO fee or the hidden labor cost behind a SaaS seat outweighs the fixed cost of building the capability once. In practice, that threshold tends to land somewhere between 75 and 150 actively credentialed providers, though PE-backed groups adding locations quarterly hit it faster than organic growth would suggest. Below that range, the fixed engineering cost rarely justifies itself. Above it, you're paying recurring per-provider fees for work that a well-built agent can do directly: logging into CAQH, PECOS, state boards, and individual payer portals, pulling verification data, flagging expirations before they lapse, and routing only the genuinely ambiguous cases to a human.

This isn't theoretical for us. Genta AI Solutions built exactly this kind of system for a healthcare staffing firm, automating primary source verification and payer portal work alongside applicant screening and performance tracking, and took credentialing cycle time from 120 days down to 30 (the full staffing operations case study covers the mechanics). That engagement served a staffing agency placing providers at other organizations, a different buyer than the MSO or medical group credentialing its own employed physicians, but the underlying workflow (document-heavy, portal-heavy, deadline-driven) is structurally identical. The same pattern shows up across Genta AI Solutions' healthcare and operations work more broadly: the diagnosis of where the real bottleneck sits matters more than which model or framework runs underneath it. A roll-up adding providers through acquisition hits the same wall from the revenue side too, which is worth reading alongside our breakdown of revenue cycle automation after a PE roll-up, since stalled enrollment and stalled revenue cycle are usually the same incident wearing two names.

Building or augmenting doesn't mean replacing PSV oversight with an unsupervised model. The compliance stakes here are too high for that, and anyone selling full automation without a human checkpoint on ambiguous cases is selling you a liability, not a solution. The right build keeps a credentialing specialist in the loop for exceptions and edge cases, and automates the repetitive 80% that's currently eating their week.

A due-diligence checklist before you commit

Whichever path you're leaning toward, ask these questions before signing anything:

• Where exactly does provider PII (SSNs, NPIs, DEA numbers, license data) live, who can access it, and what's the data retention policy after the engagement ends?

• Does the vendor or BPO actually log into and complete work inside individual payer portals, or only track status reported back by someone else?

• What's the contractual SLA on turnaround time per payer, and is there a penalty if it's missed?

• Is the process and documentation structured to satisfy NCQA accreditation standards, or will your team have to retrofit it later?

• If you're buying a seat-based platform, who on your team will own the portal work day to day, and have you budgeted for that role?

• If you're outsourcing, how does per-provider pricing change as your headcount grows, and at what provider count does the math stop favoring outsourcing?

Most groups skip the last two questions because they're evaluating the decision as a one-time purchase instead of a cost curve that moves as the organization grows. The groups that get this right revisit the build-buy-outsource question every time they cross a meaningful headcount or location threshold, rather than assuming the tool they bought at 30 providers still fits at 150.

If you're working through this decision for your own provider roster, this is exactly the kind of diagnosis work we do before recommending anything, and it's worth a conversation before you commit to another year of per-provider BPO fees or another seat-based license renewal. Genta AI Solutions builds these systems as custom AI agents when the workflow (portal interaction, document verification, status chasing) calls for it; you can see how that work gets scoped on our AI agents page, or compare notes directly.

Frequently asked questions

Is provider enrollment the same as credentialing?

No. Credentialing verifies a provider's licenses, education, and qualifications against NCQA-aligned standards. Enrollment is the separate administrative step of registering an already-credentialed provider to bill specific payers, including Medicare, Medicaid, and commercial plans. A provider can be fully credentialed and still unable to bill because enrollment with a particular payer hasn't cleared.

What is the provider enrollment process, step by step?

It typically starts with CAQH ProView data entry and attestation, followed by primary source verification of licenses and board certifications, then parallel applications to Medicare through PECOS, state Medicaid programs, and each individual commercial payer. Each payer has its own portal, required fields, and timeline, which is why enrollment for one provider can involve 40 or more separate applications.

How much does medical credentialing actually cost per provider?

Direct credentialing costs in the US typically run $2,000 to $5,000 per physician according to credentialing.org, with some sources citing $200 to $800 for less complex individual provider files. Re-credentialing, which recurs on a regular cycle, usually costs 50 to 60% of the initial credentialing cost each time it comes due.

How long does payer enrollment typically take, and why does it vary so much?

Organizations are often told 60 days, but AAPPR notes the real process can run six months or more depending on the state and payer mix. Variation comes from differing state board response times, payer-specific backlogs, and how quickly primary source verification responses come back from issuing institutions, which the provider organization rarely controls directly.

What is primary source verification, and why can't it be fully outsourced without oversight?

Primary source verification means confirming a provider's credentials directly with the issuing body (a medical board, a university, a certifying agency) rather than accepting a copy. It can't run fully unsupervised because ambiguous cases (name changes, lapsed renewals, sanctions flags) need a credentialing specialist's judgment, and NCQA accreditation standards expect documented human oversight of the verification chain.