Home › Guides › Credential renewal cycles
How often each clinician credential renews
A clinician's credentialing file runs on a dozen clocks, and each one is set by a different body: the state board, the DEA, the American Heart Association, CAQH, the health plans, the hospital, CMS. This page lists how often each one renews or needs re-checking, with a link to the rule itself, so a locum or telehealth team can see which date will lapse first.
Checked against primary sources on September 27, 2026.
The renewal table
Fifteen items a locum or telehealth credentialing file usually carries. "How often" is the rule as the issuing body states it; your facility's bylaws or a payer contract can be stricter.
| Credential | How often | Set by | Source |
|---|---|---|---|
| State medical license | Set by each state board; cycles differ by state | The state board | CME requirements by state |
| IMLC Letter of Qualification | Valid 365 days; each license issued through the Compact then renews with its own state | Interstate Medical Licensure Compact Commission | IMLCC FAQ ↗ |
| DEA registration | Every 3 years (first term 28–39 months); a separate registration in each state where you prescribe | DEA | 21 CFR 1301.13 ↗ |
| State controlled-substance registration | Where a state requires one, on that state's own cycle | The state (board of pharmacy, medicine or health) | That state's board |
| Board certification (ABMS) | Ongoing continuing certification; each member board sets its own cycle | The specialty board | ABMS standards ↗ |
| BLS / ACLS / PALS (AHA) | 2 years, through the end of the month issued | American Heart Association | AHA course cards ↗ |
| Malpractice (professional liability) | The policy term, set by the carrier | The insurer | Your policy declarations page |
| CAQH ProView re-attestation | Every 120 days (180 for Illinois providers) | CAQH (now DataSpring) | DataSpring FAQ ↗ |
| Health-plan recredentialing (NCQA) | Every 3 years | NCQA-accredited health plans | NCQA ↗ |
| Hospital reappointment | Set by medical staff bylaws; CMS recommends at least every 24 months unless state law sets a timeframe | The hospital (CMS Conditions of Participation) | 42 CFR 482.22 ↗ |
| TB screening | Baseline, then no routine annual test unless exposed (CDC 2019); a facility or state may still require one | CDC; the facility | CDC MMWR 2019 ↗ |
| OIG exclusion check (LEIE) | The list is updated monthly; OIG recommends checking monthly | HHS Office of Inspector General | OIG bulletin ↗ |
| SAM.gov exclusions | GSA publishes exclusion data daily | General Services Administration | GSA ↗ |
| NPI | Never expires; report changes to NPPES within 30 days | CMS (NPPES) | 45 CFR 162.410 ↗ |
| Medicare enrollment | Revalidate every 5 years (DMEPOS suppliers every 3); CMS can ask off-cycle | CMS | 42 CFR 424.515 ↗ |
Three things that trip up multi-state teams
-
Per state
One DEA registration does not cover every state
DEA regulations require a separate registration for each principal place of professional practice, and DEA's telemedicine guidance says a practitioner needs a registration in the state where the patient is, with limited exceptions. The COVID-era exception was tied to the public health emergency. A clinician who prescribes controlled substances to patients in eight states may need eight DEA registrations, each on its own 3-year clock.
DEA registration Q&A ↗ -
Fastest clock
CAQH lapses before anything else
At 120 days, CAQH re-attestation comes due about three times a year: more often than any license, card or registration in the file. A lapsed profile shows as Expired to every health plan that reads it, which can stall payer enrollment for the whole group.
DataSpring (CAQH) FAQ ↗ -
Site policy
"Annual TB test" is usually a facility rule, not a CDC one
CDC's 2019 update dropped routine annual TB testing for health care personnel after a baseline screen. Many facilities still ask for one each year. Track the requirement per site rather than assuming every placement needs a new test.
CDC MMWR, May 2019 ↗
Interstate Medicine Ledger keeps each clinician's licenses, DEA and state controlled-substance registrations, board certifications, BLS/ACLS/PALS cards, malpractice, TB/flu/N95 dates, CAQH attestation and facility reappointments in one record. With the clinician's consent, an agency sees one roster sorted by what expires first. Each month it also checks names and NPIs against the OIG exclusion list, the CMS opt-out and Order & Referring files, and NPPES. It organizes and flags; it is not primary-source verification, and it does not make your credentialing decisions.
See the Ledger for Teams & Agencies →Frequently asked questions
How often does a DEA registration renew?
Every 3 years. A new practitioner's first registration runs 28 to 39 months because DEA staggers renewal groups; after that, each renewal lasts 36 months (21 CFR 1301.13). DEA also requires a separate registration in each state where the practitioner prescribes controlled substances, with limited exceptions.
How long are BLS, ACLS and PALS cards valid?
The American Heart Association says its BLS, ACLS and PALS course completion cards are valid for two years, through the end of the month in which the card was issued.
How often do providers have to re-attest in CAQH ProView?
At least every 120 days (every 180 days for Illinois providers). If the deadline passes, the profile's status changes to Expired and health plans stop receiving current data. CAQH now operates as DataSpring.
Is annual TB testing required for health care workers?
Not by the CDC. Its 2019 recommendations call for baseline TB screening and then no routine serial testing at any interval after baseline, unless there is a known exposure or ongoing transmission. People with untreated latent TB infection get an annual symptom check, and everyone gets annual TB education. A state or a facility can still require annual testing, so check each site's policy.
How often should an agency check the OIG exclusion list?
Monthly. The OIG updates the List of Excluded Individuals/Entities monthly and says screening each month best minimizes liability. For most providers that is a recommendation rather than a legal requirement; state Medicaid agencies must check it monthly.
Researched against the primary sources linked on this page as of 2026-09-27. Informational, not legal or compliance advice: rules change, and your state board, DEA, payer contracts and facility bylaws control. Verify before relying on any entry.