How to Vet a Credentialing Vendor Without Getting Burned

You write a check for $4,200, hand over your CAQH login, and wait. Six weeks later, three of the five payer applications haven't been submitted, the credentialing coordinator you were assigned has been reassigned twice, and the contract you signed says nothing about the timeline the sales rep promised on the call. The vendor hasn't broken any rules. You just didn't know which rules to ask about before you paid.

Credentialing vendors cost between $2,000 and $8,000 for a full panel setup, and the ones worth hiring save weeks of approval time and catch payer-specific errors that would otherwise kick you back three months. The ones that aren't will cash your check and leave you explaining why your practice still can't bill Aetna.

Here's the vetting checklist independent practices use before they sign, organized by what vendors legitimately deliver, what they can't, and the questions that separate the two.

What a credentialing vendor actually does (and doesn't)

A credentialing vendor handles the mechanical work of getting a provider approved to bill specific payers. The legitimate scope has four parts.

Keep CAQH current. CAQH ProView is the database most commercial payers pull from to verify credentials, requiring re-attestation every 120 days. A vendor should run the attestation cycle plus update license expirations, malpractice COIs, and W-9 swaps as they happen.

Prepare and submit payer applications. Every payer has its own format, supplemental forms, and supporting-document requirements (Aetna asks for items Cigna doesn't; BCBS varies by state). A vendor fills out each application correctly the first time.

Follow up on pending applications. Payers sit on applications, request additional documentation, lose uploads, and occasionally deny for clerical reasons. A vendor calls every two to three weeks. Self-handling this runs roughly 20 minutes per payer per month during an active panel cycle.

Track recredentialing windows. Payers recredential every two to three years. The vendor should maintain a calendar and file at 90 days before the deadline.

What a credentialing vendor cannot do, no matter what the sales call suggests:

They cannot negotiate rates. Commercial fee schedules are set by the payer. An independent practice owner we track in credentialing discussions put it directly: "Billing and credentialing companies don't have an edge to negotiate rates for you." Rate negotiation is a separate service handled by an RCM consultant or attorney, after you have claims history to argue with.

They cannot guarantee a timeline. The insurance company sets the clock. A vendor can submit a clean application the same day you hire them and still wait 90 days for BCBS. Any "guaranteed timeline" on a website is marketing, unless it's in your contract with a specified remedy.

They cannot guarantee approval. If anything in a provider's licensing history triggers payer underwriting, no vendor can make that go away. Good vendors flag those issues before they submit; bad vendors submit and hope.

Red flags in vendor selection

Six signals predict trouble before you sign. Two or more, walk.

Opaque or percentage-based pricing. Credentialing should price as a flat per-payer fee ($100 to $400 per payer) or a flat package rate for a defined panel. Percentage-of-collections pricing for credentialing alone is a red flag because credentialing is a finite-scope project, not an ongoing service. If a vendor quotes a percentage, ask them to itemize the work that justifies it. Refusal is the answer.

"Guaranteed timelines" that aren't in the contract. Sales copy saying "30-day credentialing" means nothing unless the contract also says what happens when the timeline slips. Ask: if the application sits with BCBS past day 90, what's the remedy? Refund? Fee reduction? Free recredentialing next cycle? The answer tells you whether the timeline is a promise or a poster.

Won't name payer contacts or provider relations reps. A vendor credentialing in your state should be able to name at least three payer-specific contacts and the rough approval rate for applications to those payers. If they can't, they've either never credentialed there or they've outsourced the calls to a general call center.

Won't share sample packets (PHI redacted). A clean sample application demonstrates the vendor knows the payer's quirks. Asking to see one is reasonable due diligence. Refusal usually means the samples aren't clean.

No SOC 2 Type II, no HIPAA BAA. You're handing over CAQH logins, license copies, malpractice COIs, and SSNs. The vendor is a Business Associate under HIPAA. If they won't sign a BAA or can't produce a SOC 2 Type II report, the legal exposure when something leaks is yours.

Aggregator platforms pitching as credentialing vendors. Headway, Alma, and Grow Therapy are practice aggregators. You credential under their network contracts with payers, not under your own PLLC. You see clients and get paid, but your own business is not on those payer panels, and you can't take the credentialing with you when you leave. Both are legitimate choices for different goals; they aren't interchangeable, and some vendors sell into the confusion deliberately.

The vetting checklist

Seven questions, in this order, before a signature.

1. Written scope of work. Not a sales PDF. A document listing the specific payers being credentialed, which forms the vendor handles vs. which forms you handle, whether CAQH management is included or extra, and whether recredentialing in two to three years is included or a separate contract. If the scope isn't in writing, it isn't real.

2. Timeline in contractual language. "We usually see approvals in 60 to 90 days" is a data point, not a commitment. Ask for the remedy if milestones slip: first submission within N days, first follow-up within N days of payer silence, escalation to payer management after N days. Remedies can be partial refunds, fee reductions, or additional payers at no cost. Any remedy is better than none.

3. Three references from practices in your specialty and state. Specialty matters because a vendor who credentials primary care isn't automatically fluent in ABA billing codes or PMHNP paneling, and state matters because Medicaid MCO rules vary dramatically. Call the references. Ask "what got dropped?" not "how was it?"

4. CAQH turnover rate. The percentage of clients whose CAQH profiles lapse attestation under the vendor's watch. Good vendors track it. Bad vendors have never been asked. A lapsed attestation takes a provider off payer panels, and reinstatement runs six to eight weeks.

5. Exit terms in writing. What happens to credentialing data, CAQH admin rights, and in-progress applications if you fire the vendor? Contract language, not verbal. Specifically: who gets primary admin on CAQH, who keeps the work-in-progress files, what's the notice period.

6. SOC 2 Type II plus signed BAA before sharing PHI. SOC 2 Type II (not Type I, a point-in-time audit) demonstrates security controls maintained over a 6-to-12-month observation period. BAA is a federal requirement anyway; treat refusal or delay as disqualifying.

7. Review a sample packet end-to-end. Request a de-identified clean sample of a submitted application for a payer you'll be credentialing with. Check it against the payer's current application requirements on the payer's own website. If the sample has blanks the payer's current form requires, the vendor is submitting bad applications.

Comparing vendor tiers

Independent-practice credentialing vendors cluster into three tiers, mostly by client size and price point. Not all of them fit a solo or small group.

Independent-practice scale. Credex Healthcare shows up frequently in practitioner discussions as a 50-state operator that bundles credentialing with billing. Evercred gets named by practices wanting a smaller-shop experience and direct account management. MEG Business Management is PT-specialty-focused; for a physical therapy practice, MEG is worth a reference call before the generalists. Corpus mentions are not endorsements. Run all three through the vetting checklist.

Mid-market, balanced critique. Medallion is the credentialing arm SimplePractice and similar EHRs integrate with. Field reports split: some practices get clean paneling; others get handed off between coordinators with no single point of contact on escalations. If Medallion is on your list, ask specifically how escalations work and who's named on your account.

Enterprise-only. Verity Stream and Verifiable work with large hospital systems and health plan networks. They aren't priced for independent practices. If a sales rep from either is quoting you, ask why.

The aggregator wall. Headway, Alma, and Grow Therapy are not credentialing vendors. They are practice aggregators that credential you under their network, not under your PLLC. This is a distinct decision, covered in the Credentialing Path Picker and the independent practice credentialing guide.

Common mistakes practitioners make

Paying in full upfront, no milestone release. A ten-payer engagement has natural milestones: CAQH clean and attested, application submitted, first approval, final approval. Payments should track milestones, not calendar dates. 100% upfront leaves the vendor with less incentive to finish than you have.

Skipping the reference call. Sales polish is independent of execution quality. The reference call is where you find out what got dropped and whether the follow-up calls actually happened.

Assuming recredentialing is included. The original contract covers first submission. Recredentialing two to three years later is frequently a separate contract with separate pricing, and the vendor may not remind you it's coming. Read the recredentialing clause before signing, and calendar the deadlines yourself.

Not transferring CAQH admin rights back on exit. If the vendor holds primary admin when you terminate, you can end up locked out of your own profile during the transition. Require in writing that primary admin transfers back within 10 business days of termination.

Missing the PLLC or EIN-change re-credentialing trap. When a provider changes from sole proprietorship to PLLC, or changes EIN for any reason, most payers require a full re-credentialing application, not an update. Practices get blindsided because it feels administrative. Before changing your entity, ask each payer whether the change triggers re-credentialing. If it does, time the change around a recredentialing cycle you'd already be running.

The bottom line

A credentialing vendor is worth hiring when your time is worth more than the per-payer hours required to handle the work yourself, when you're credentialing across enough payers and states that the mechanical load is meaningful, and when the specific vendor clears the seven-question vetting checklist. A vendor is not worth hiring to negotiate rates (they can't), to promise timelines (they can't control them), or to bundle into a billing contract without separate scope clarity on each side.

Run a BBB complaint search on the vendor name before signing, and a CMS Provider Enrollment readiness check on your Medicare setup. The vendors that earn the work write clear scopes, track CAQH turnover, sign a BAA before they get PHI, and return CAQH admin when you leave. The ones that don't will charge you anyway.

For the underlying credentialing strategy, start with the practice credentialing roadmap and the credentialing timeline template.

Frequently asked questions

How much does a credentialing vendor actually cost?

Most independent-practice vendors price at $100 to $400 per payer for initial credentialing, or $2,000 to $8,000 for a full panel package covering 8 to 15 payers. Bundled arrangements that include recredentialing cost more upfront but protect against surprise bills at renewal. Percentage-of-collections pricing for credentialing alone is rare among reputable vendors; if you see it, ask for itemized justification.

Are credentialing vendors worth it for a solo practice?

It depends on how many payers you're credentialing with and what your time is worth. Credentialing yourself runs roughly 20 to 30 minutes per payer on setup plus ongoing follow-up phone time during the approval window. A solo provider credentialing with three to five payers can reasonably handle it themselves. A solo provider credentialing with twelve payers across two states is usually better off hiring out. The math flips around five to six payers for most practices.

What's the difference between a credentialing vendor and an aggregator like Headway?

A credentialing vendor gets your practice credentialed under payer contracts you own. You can take those credentials with you when you change EHRs or business structure (within re-credentialing rules). An aggregator like Headway, Alma, or Grow Therapy credentials you under their own payer network contracts. You see clients through their platform and get paid through them, but your PLLC is not directly on those payer panels. If you leave the aggregator, you don't keep the credentialing.

Can a credentialing vendor help me negotiate better rates?

No. Commercial payer fee schedules are set by the payer, and the vendor's role ends at "application accepted." Rate negotiation is a separate service, typically handled by an RCM consultant or healthcare attorney, and it works best after you have 6 to 12 months of claims history to argue with.

How do I switch credentialing vendors mid-contract?

Read the current contract's termination clause first. Most require 30 to 60 days written notice and a transition period. During that period, require in writing that the outgoing vendor transfer CAQH admin back, hand over work-in-progress files, and summarize every pending application. Don't sign with a new vendor until the transfer is complete, or you'll have two vendors managing the same applications.

What happens to my CAQH profile if I stop using a vendor?

Your CAQH profile belongs to you. The vendor is usually assigned primary administrator during the engagement, and when the engagement ends those rights transfer back to you or to a new vendor you designate. If the vendor resists or delays the transfer, CAQH has a provider self-service process to reclaim admin rights, but it takes weeks and can cause attestation lapses.

Should I use the billing company's credentialing service?

Bundled billing-plus-credentialing can be a fair deal if the seven-question vetting checklist is applied to the credentialing work specifically. The risk is scope-creep pricing: credentialing is thrown in free, billing is priced to subsidize it, and the credentialing quality is the first thing cut when the vendor is overbooked. Require separate scope documents for each service inside a single contract, and ask for credentialing-specific references independent of billing references.