Hospital Staff Credentialing and Licence Expiry Tracking

The expiry nobody saw coming

Most hospitals do not lose control of credentials in one dramatic failure. They lose it a few days at a time. A nurse's life support card expires at the end of a month. The reminder sits in a spreadsheet no one opened. A locum's licence is renewed, but the new copy never reaches the file. When a surveyor asks, the answer takes a week of searching.

Blaming the nurse or the clerk is easy, and it misses the point. The fault sits in the records. Records can be fixed with a few firm decisions, and the rest of this piece sets them out, starting with what the words mean.

Credentialing, privileging and primary-source verification

Credentialing confirms that a person holds what they say they hold. Australia's Commission on Safety and Quality in Health Care defines it as "the formal process used by a health service organisation to verify the qualifications," along with experience and professional standing.

Privileging decides what a credentialed clinician may do in this facility. In the United States, the Medicare hospital Conditions of Participation require medical staff bylaws to include "criteria for determining the privileges to be granted to individual practitioners." The same regulation requires the medical staff to examine the credentials of every eligible candidate and to appraise members periodically. Australia calls the equivalent step defining scope of practice: "the extent and boundaries of a clinician's approved clinical practice."

Primary-source verification is how credentials are checked. The Joint Commission defines it as verification of reported qualifications "by the original source or an approved agent of that source." That means the licensing board, the university or the certifying body, reached by direct correspondence, a documented phone call, secure electronic verification or an approved credentials verification organisation. A photocopy handed in by the employee is not enough. The Joint Commission is explicit: "It is the responsibility of the accredited organization to complete PSV, not the licensed individual." The record must show when the verification was done and who did it.

Credentialing is not a one-time event. The Australian guidance recommends re-credentialing "at intervals of 3-5 years," and sooner when concerns arise or a clinician's registration changes. For organisations accredited by NCQA, mostly health plans and their delegates, the 2025 standards shortened the time allowed between verification and the credentialing decision to 120 days, from 180, according to a summary by the law firm Horty Springer.

Where the usual system breaks

In many hospitals and clinics, credential tracking lives in a spreadsheet kept by one person in HR or medical affairs. It works until it does not. The failure points are predictable.

• Expiries are noticed after the fact. A spreadsheet reminds no one. If the person who keeps it is on leave, nothing moves.
• Short-cycle certificates slip first. American Heart Association course cards, including BLS and ACLS, are valid for two years and expire on the last day of the month the course was taken, as Vanderbilt University Medical Center's resuscitation programme explains. With hundreds of staff on staggered two-year cycles, some card is always close to lapsing.
• Copies replace verification. A scanned licence shows what the employee submitted, not what the board holds today.
• No one owns the item. HR assumes the department head is chasing it. The department head assumes HR is.
• History is overwritten. When a date is edited in a cell, the old value and the reason for the change disappear. An auditor cannot tell a renewal from a correction.

None of these failures is dramatic. Together, they mean a hospital cannot say with confidence, on any given morning, who is currently qualified to do what.

A credential register that holds up

A reliable system needs no special technology to start. It needs five decisions, made once and kept.

• One register. Every licence, registration, certification and mandatory course for every staff member lives in one place. Not one spreadsheet per department, and not a folder of emails.
• One owner per credential. Each item has a named person responsible for chasing renewal, usually the line manager, with a credentialing officer as backup. The staff member renews; the owner makes sure it happens.
• Fixed expiry windows. Alerts go out at 90, 60 and 30 days before expiry. At 90 days, the staff member books renewal. At 60, the owner confirms the date. At 30, the item is escalated and rostering is told. Ninety days is not arbitrary: at Vanderbilt, for example, online renewal courses open 90 days before a card expires.
• An evidence file. Each credential carries its proof: the result from the original source, the date it was checked and who checked it. A credential without evidence shows as unverified, not as valid.
• An audit trail. Every change is recorded with who made it, when and why. Old values are kept. This is the spirit of NCQA's 2025 Credentialing Information Integrity standard, which, per Horty Springer, asks organisations to define how updates are documented and to audit for improper changes.

Consider a hypothetical ward with 40 nurses, each holding a registration and a BLS card. That is 80 dated items before any specialty course is added. On two-year cycles, one or two BLS cards fall due almost every month. With fixed windows and named owners, each one is a routine task. Without them, each one is a surprise.

The register should answer three questions at once: who is out of date today, who will be within 90 days, and which items have no verified evidence. If it cannot, it is only a list.

What to never track

A credential register is about qualifications, not behaviour. It should hold what a person is licensed and certified to do, and when that ends. It should not log keystrokes, badge movements, time spent in systems or messages sent. Activity tracking says nothing about whether someone is qualified, and it erodes the trust that makes staff report their own renewals on time.

Keep the scope narrow. Collect the documents your regulator and your own policies require. Let staff see their own record and the evidence held about them. Decisions about privileges, scope and employment stay with credentials committees and managers who can be held to account. Software can sort dates and send reminders. It should not judge people.

How Refraction does this

Refraction is Roadyom's people system. It keeps staff records, the org chart, time off, rosters, onboarding and credentials in one place. Each licence and certification has an expiry date, an owner, an evidence file and a full history of changes. Records are checked against your institution's own framework rules, such as which roles require which credentials, so gaps show up before a shift or a survey. Refraction does not track activity. It holds what people are qualified to do, and leaves decisions to the people responsible for them.

Sources

1. Verification - Primary Source Verification - Definition (Ambulatory Health Care). The Joint Commission, 2026.
2. Verification - Primary Source Verification - Definition (Home Care). The Joint Commission, 2026.
3. Credentialing and defining scope of practice: Guidance for health services and clinicians. Australian Commission on Safety and Quality in Health Care, 2026.
4. 42 CFR § 482.22 – Condition of participation: Medical staff. Legal Information Institute, Cornell Law School, 2026.
5. Question of the Week, February 27, 2025: NCQA credentialing standard changes. Horty, Springer & Mattern, 2025.
6. Resuscitation Program FAQs. Vanderbilt University Medical Center, 2026.

Comments

Your nameYour comment

Comments appear after our team reads them. Please do not include patients' or colleagues' personal details.

Post comment