A nurse practitioner joined a family practice we support, and the office manager did everything right on her side: the Medicare enrollment went in through PECOS the first week, the Medicaid application the second. Then the first commercial payer replied with one line: "We will pull the application from CAQH." The NP had a CAQH profile from her previous employer. Its attestation had expired seven months earlier, the malpractice certificate on file belonged to a practice she no longer worked for, and the only practice location listed was in another city. The payer could not start. Six weeks passed before the profile was fixed, re-attested and authorized, and those were six weeks the NP saw patients whose claims could not be billed to that plan.
That is the quiet cost of CAQH. It is not hard. It is just invisible until it blocks something, and then it blocks everything. This guide is the walkthrough we give practice managers who are setting up a provider for the first time or inheriting a profile that has been neglected.
CAQH ProView is a free, central online database where a clinician enters one credentialing profile, uploads the supporting documents, attests to its accuracy, and authorizes health plans to pull it instead of filling out each plan's application. The organization behind it, CAQH, now operates under the DataSpring name, and the product has been renamed the CAQH Provider Data Portal, but the login address is still proview.caqh.org and nearly every payer and credentialing specialist still says "CAQH" or "ProView". A complete first-time setup takes two to four hours if the documents are gathered first. Re-attestation takes ten to fifteen minutes and is required every 120 days. A profile with an expired attestation, missing documents or no authorization for a plan will stall that plan's credentialing until it is fixed.
Before you start: what to gather
Every slow CAQH setup we have watched was slow for one reason: the person at the keyboard stopped every ten minutes to go find something. Collect the following before opening the portal, in a folder named for the provider, with the documents as clean PDFs (a photo of a license taken on a phone is routinely rejected by the document reviewers).
- Identifiers: the individual NPI (Type 1), Social Security number, date of birth, and the Medicare PTAN and Medicaid provider numbers if already issued.
- Licenses and registrations: every state medical or professional license, number, issue and expiration date; DEA registration and expiration; state controlled substance registration where the state issues one.
- Education and training: school, degree, start and end dates (month and year), internship, residency and fellowship programs with dates and program director names.
- Board certification: board name, specialty, certificate number, initial certification date and expiration or recertification date.
- Work history: every employer for at least the past ten years with month and year start and end dates, and a one-sentence explanation for any gap longer than six months (payers ask; the portal flags them).
- Hospital affiliations: each hospital, privilege status (active, courtesy, consulting), and department; if the provider has no admitting privileges, the name of the admitting arrangement or hospitalist group the practice uses.
- Professional liability insurance: the current certificate of insurance showing carrier, policy number, effective and expiration dates, per-claim and aggregate limits, and whether the policy is claims-made or occurrence; plus a ten-year history of any claims, settlements or judgments.
- Practice location details: for each location, the legal name and doing-business-as name, street address, phone and fax, Tax ID, group NPI (Type 2), office hours, whether the provider accepts new patients, languages spoken, accessibility, the office manager's name and the billing address if different.
- A current CV in month-and-year format that matches the dates entered in the portal exactly.
- State-specific forms if the practice state requires a signed state credentialing application or release that the portal will ask for.
Step 1: get a CAQH Provider ID
A provider needs a CAQH Provider ID before anything else. There are two ways to get one. The first is an invitation: when a health plan the provider has applied to is a CAQH participating organization, it adds the provider to its roster and CAQH sends a welcome email with the ID and registration instructions. The second, and the one we use so nobody is waiting on a payer, is self-registration at proview.caqh.org. The registration page asks for the provider's name, NPI, date of birth, primary practice state, email address and a few identifying details, and it checks whether a profile already exists for that NPI so duplicates are not created. If a profile already exists from a previous employer, this is the moment you find out, and the recovery path is to use the account recovery link rather than to register again.
This step takes about ten minutes. Save the CAQH Provider ID in the provider's credentialing file; every payer application for the rest of the provider's career will ask for it. Save the username and the answers to the security questions in the practice's password manager, not in a desk drawer, because the practice will need them long after the provider forgets them.
Step 2: set up the account and complete Personal Information and Professional IDs
On first login the portal asks the provider to create a username and password and choose security questions, then lands on a home page with a profile status panel: the percentage complete, the attestation status, documents needing attention and any required fixes. The left-hand menu lists the data sections in the order they should be completed.
Personal Information asks for legal name exactly as it appears on the license, any other names used (maiden name, prior name), home address, contact details, birth information, citizenship and languages. Professional IDs asks for each license with state, number, issue and expiration dates, the DEA number and expiration, any state controlled substance registration, the NPI, Medicare and Medicaid numbers, and historical identifiers such as a UPIN if the provider has one. Enter dates exactly as they appear on the documents you will upload; the document reviewers compare them, and a mismatch between the license expiration typed here and the one on the PDF is the most common reason a document is rejected. These two sections take 20 to 30 minutes.
Step 3: Education, Professional Training and Specialties
Education asks for the professional school, degree, and start and end dates. Professional Training asks for each internship, residency and fellowship with the institution, program type, specialty, dates and whether it was completed. Specialties asks for the primary specialty and any secondary specialties, and for each one whether the provider is board certified, by which board, with the certificate number and the dates. If the provider is board eligible rather than certified, the portal has a field for that, and payers read it carefully.
The trap here is approximate dates. A residency entered as starting in July when the certificate says June creates a one-month "gap" that a payer's credentialing analyst will question. Use the documents, not memory. This step takes 20 to 40 minutes depending on how many programs the provider completed.
Step 4: Practice Locations
This is the longest section and the one with the most downstream consequences, because payers build their directories and their claim systems from it. For each location the portal asks for the practice name, address, phone and fax, the Tax ID and group NPI the provider bills under at that site, the office hours, whether the provider is accepting new patients, patient age limits, languages, accessibility features, the office manager and credentialing contact, and the billing and correspondence addresses if different. It also asks which practice location is the primary one.
Three mistakes recur. First, old locations are left active after a provider leaves; mark them as ended with the termination date rather than deleting them, because payers need the history. Second, the Tax ID or group NPI is entered for the wrong location in a multi-site group, and claims later deny because the payer loaded the provider under the wrong group. Third, the "accepting new patients" flag is set once and never updated, which is a directory accuracy problem that plans now audit. Groups with more than a handful of providers should ask about the Practice Manager module, a companion tool that lets the practice enter location data once and push it to each provider's profile. This step takes 30 to 60 minutes for a single location, longer for several.
Step 5: Hospital Affiliations, Professional Liability Insurance, Employment and References
Hospital Affiliations asks for each hospital with the privilege type and dates; if the provider has none, there is an option to say so and to describe the admitting arrangement. Professional Liability Insurance asks for the carrier, policy number, coverage type, effective and expiration dates, and per-claim and aggregate limits, and it will ask you to upload the certificate in Step 7. Employment Information asks for the current and previous employers with addresses and month-and-year dates; the portal flags gaps over six months and asks for an explanation (the practice can write "relocation" or "parental leave" and that is sufficient). Professional References asks for peer references, usually three, with names, specialties and contact details; many payers still verify these by letter, so choose colleagues who will respond.
Together these sections take 30 to 45 minutes. The number to get right is the malpractice coverage: payers compare the limits in the profile to their minimum requirements (one million per claim and three million aggregate is a common threshold for physicians), and a provider covered under the practice's group policy should enter the group policy details, not a prior employer's.
Step 6: Disclosure questions
The Disclosure section is a series of yes-or-no attestation questions about license actions, DEA actions, hospital privilege restrictions, malpractice history, criminal history, Medicare or Medicaid sanctions, and physical or chemical impairment that could affect practice. Every "yes" opens a text box for an explanation and may require a document. Answer honestly and completely; payers verify these against the National Practitioner Data Bank, the OIG exclusion list and state boards, and an undisclosed item found during verification is treated far more seriously than a disclosed one. Ten minutes for most providers, longer if there is history to explain. A provider with a complicated history should have counsel review the explanations before they are entered.
Step 7: upload the supporting documents
The Documents section lists what the portal expects based on the data entered: each state license, the DEA certificate, the state controlled substance registration, the malpractice certificate of insurance, board certificates, the CV, and any state-mandated credentialing forms or releases. Each upload is tagged with its document type and, where relevant, its expiration date. After upload, CAQH's document review team checks each file against the data in the profile; in our experience this takes a few business days, and the document shows as approved or rejected with a reason. Common rejection reasons: an expired document, a document that does not match the typed data, a certificate with the wrong provider name (the group policy certificate must list the provider as a named insured or be accompanied by a roster), and image files that are cropped or unreadable.
The portal also generates the authorization and attestation release form that some payers and states require with a wet or electronic signature. Print, sign, scan and upload it the same day; a profile waiting on a signature page is a profile payers cannot use. Budget 30 minutes for uploads plus the review wait.
Step 8: authorize the health plans
The Authorization section controls which participating organizations may view the profile. The two options are global authorization, which allows any participating plan that has the provider on its roster or receives a request from the provider to access the data, and individual authorization, where the provider ticks each plan by name. We recommend global authorization for almost every provider. A plan cannot see the profile until it has added the provider to its roster, so global authorization does not broadcast the data; it simply removes a step that otherwise fails silently when a new plan is added and nobody remembers to tick the box. Providers who have a specific reason to withhold data from a specific plan can use individual authorization and accept the maintenance burden. Five minutes.
Step 9: review and attest
The Review and Attest page runs a completeness check and lists required fixes: a missing date, a section left incomplete, a document not yet uploaded. Clear every item; the portal will not let the provider attest with required fixes outstanding, and payers treat suggested fixes almost as seriously. When the list is empty, the provider (or the delegate acting with the provider's authorization, where the practice has set that up) reads the attestation statement and clicks Attest. The page confirms the attestation date and the profile status changes to complete and attested.
Save three things from this screen: the attestation confirmation, the date, and a calendar reminder set 100 days out. The attestation is the event payers look for. A profile that is complete but not attested is, to a payer, not complete. First-time attestation takes 15 to 30 minutes including the fixes.
Step 10: maintain the profile every 120 days and whenever anything changes
CAQH requires re-attestation every 120 days, and it sends email reminders as the date approaches. Re-attestation is a review of each section, updating anything that changed, and clicking Attest again; ten to fifteen minutes when nothing has changed. If the deadline passes, the profile status shows as expired and plans pulling the profile see that the data is stale; most will pause credentialing or recredentialing until it is refreshed, and some directory programs flag the provider.
Between attestations, the profile must be updated when something changes, and the documents must be replaced before they expire: licenses and DEA registrations on their renewal cycles, the malpractice certificate every policy year, board certification at recertification. The portal shows expiring documents on the home page, but someone in the practice has to look. The routine that works is a credentialing calendar with four entries per provider: the next attestation date, the license expiration, the DEA expiration and the malpractice renewal, each with a 30-day lead reminder, owned by a named person. Practices with several providers should designate one credentialing coordinator with delegate access to every profile, and the provider should still be the one who reads and clicks Attest, because the attestation is a personal statement of accuracy. Our credentialing timeline tool shows where CAQH attestation sits relative to the payer's own steps, and our credentialing and provider enrollment service maintains these calendars for the practices we support.
How long each step takes and what to save
| Step | Time (documents in hand) | What to save |
|---|---|---|
| 1. CAQH Provider ID and registration | 10 minutes | Provider ID, username, security answers in the password manager |
| 2. Personal Information and Professional IDs | 20 to 30 minutes | Nothing extra; confirm dates match the documents |
| 3. Education, Training, Specialties | 20 to 40 minutes | Nothing extra; confirm dates match the CV |
| 4. Practice Locations | 30 to 60 minutes per practice | The Tax ID and group NPI used per location |
| 5. Affiliations, Liability, Employment, References | 30 to 45 minutes | Gap explanations; reference contact confirmations |
| 6. Disclosure | 10 minutes | Copies of any explanations entered |
| 7. Documents | 30 minutes plus a few business days of review | Approved document list with expiration dates |
| 8. Authorization | 5 minutes | Note of global or individual authorization chosen |
| 9. Review and Attest | 15 to 30 minutes | Attestation confirmation and date; reminder at 100 days |
| 10. Re-attestation and maintenance | 10 to 15 minutes every 120 days | Updated credentialing calendar |
Questions we hear
How long does CAQH attestation take?
Re-attestation of an existing, current profile takes ten to fifteen minutes: review each section, update anything that changed, click Attest. A first-time attestation takes two to four hours of total work when the documents are gathered in advance, spread over a few days because the document review by CAQH has to finish before the profile is fully usable. Payers then take their own time to pull the profile and start verification; CAQH being complete is the start of the payer's clock, not the end.
Is CAQH ProView free for providers?
Yes. There is no charge to the provider or the practice to register, maintain a profile or attest. The service is funded by the participating health plans. If a website asks for payment to "register your CAQH", it is a third-party service, not CAQH.
Does completing CAQH mean the provider is credentialed?
No. CAQH stores and shares the application data; it does not credential anyone. Each health plan still runs its own primary source verification, committee review and contracting, and each has its own timeline, often 60 to 120 days after it receives a complete application. CAQH removes the step of filling out every plan's form, and an incomplete or expired profile adds weeks because the plan cannot begin.
What happens if the provider misses the 120-day re-attestation?
The profile status changes to expired. Plans that pull the data see that it has not been attested within the required window, and most will not accept it for credentialing or recredentialing until it is refreshed. Nothing is deleted; the provider logs in, reviews, and attests, and the status returns to current. The damage is the delay on whatever the plan was doing at the time, and the fact that the practice usually finds out from the plan rather than from the portal.
Can the practice manager maintain CAQH on the provider's behalf?
Yes, with the provider's knowledge and consent, and we recommend it. The practical arrangement is a credentialing coordinator who holds the login details in the practice's password manager, updates the data and documents, clears the required fixes, and then has the provider read the attestation statement and click Attest, or attest on the provider's behalf where the provider has authorized that in writing. Groups with many providers should look at the Practice Manager module for bulk location updates. What does not work is the provider owning the login alone and the practice finding out about an expired attestation from a payer.
Do all payers use CAQH?
Most national and regional commercial plans do, and many Medicaid managed care plans and some Medicaid agencies do as well. Original Medicare does not; Medicare enrollment goes through PECOS and the CMS-855 applications. State Medicaid fee-for-service programs mostly use their own enrollment portals. Some plans use a competing credentialing verification organization or their own application in specific states. The payer's provider enrollment page will say which it uses, and the credentialing timeline lists the usual path for each payer type.
Sources and references
- DataSpring, powered by CAQH: For Clinicians, DataSpring: the provider-facing overview of the CAQH Provider Data Portal (formerly ProView), the 120-day attestation cycle and the no-cost model.
- Provider Data Management, DataSpring: how the portal shares attested data with authorized health plans and what plans receive from it.
- DataSpring Support, DataSpring: phone and chat support hours for practitioners and practice managers using the Provider Data Portal.
- DataSpring University, DataSpring: training videos, FAQs and fact sheets for completing and maintaining a profile.
- NPPES, CMS: the National Plan and Provider Enumeration System where the individual (Type 1) and group (Type 2) NPIs entered in the profile are issued and updated.
- NPPES NPI Registry, CMS: the public lookup for confirming the NPI, taxonomy and practice address on file before entering them in CAQH.
- Become a Medicare Provider or Supplier, CMS: Medicare enrollment through PECOS and the CMS-855 forms, the path Medicare uses instead of CAQH.
