Opinion Article
The Hidden Risk in Healthcare Acquisitions
When private equity firms, health systems, or physician groups acquire medical practices, they conduct extensive financial and legal due diligence. They review revenue, contracts, real estate, equipment, and staffing. But one area frequently receives insufficient attention: provider credentialing.
Credentialing gaps can create post-acquisition nightmares: providers who can't bill, payer contracts that don't transfer cleanly, licenses about to expire, and compliance violations inherited from the previous owner. These issues can delay revenue realization by months and cost hundreds of thousands of dollars to remediate.
This article provides a comprehensive due diligence checklist for credentialing in healthcare M&A transactions.
Why Credentialing Due Diligence Matters
The Regulatory Reality
Healthcare organizations operate under a vast array of federal and state laws, including HIPAA, Stark Law, Anti-Kickback Statute, False Claims Act, and specific licensing and accreditation requirements. Failures in compliance can result in massive fines, exclusion from government programs, and even criminal penalties.
Mergers and acquisitions can be complicated for healthcare organizations because they operate in a highly regulated industry. There is significant risk that a purchaser could inherit serious regulatory liabilities.
Real-World Consequences
In documented cases:
- A nursing home chain owner failed to reveal it was subject to a corporate integrity agreement for billing irregularities
- A hospital seller did not disclose it owed Medicare almost $2 million due to cost report overpayments
- Practices acquired with lapsed credentials required months of remediation before providers could bill
These aren't hypothetical risks—they're documented failures that proper due diligence would have identified.
Patient Safety Implications
Patient safety hinges on healthcare provider qualifications and competency. Without rigorous credentialing verification, an acquirer risks employing unqualified practitioners, exposing the organization to malpractice claims and patients to potential harm.
The Credentialing Due Diligence Checklist
1. Provider License Verification
For every provider in the practice:
| Item | Verify |
|---|---|
| State medical license(s) | Active status, expiration date, any restrictions |
| DEA registration | Active status, expiration date, schedule coverage |
| State controlled substance registration | If required by state, verify active status |
| Board certification | Current status, MOC compliance if applicable |
| ECFMG certification | For international medical graduates |
Red flags: Licenses expiring within 90 days of close, any restrictions or probationary status, gaps in licensure history.
2. Payer Enrollment Status
| Item | Verify |
|---|---|
| Medicare enrollment | Active PECOS status, correct practice location |
| Medicaid enrollment | State-specific enrollment, any exclusions |
| Commercial payer panels | Active status with each contracted payer |
| Credentialing effective dates | Ensure no gaps in coverage |
Red flags: Providers not enrolled with major payers, pending enrollment applications, recent denials or terminations.
3. Hospital Privileges
| Item | Verify |
|---|---|
| Current privilege status | Active at all claimed hospitals |
| Privilege scope | Matches procedures performed |
| Reappointment dates | When privileges need renewal |
| Any adverse actions | Restrictions, suspensions, investigations |
Red flags: Voluntary relinquishment of privileges, any privilege restrictions, pending peer review matters.
4. Disciplinary History
| Source | Check For |
|---|---|
| NPDB (National Practitioner Data Bank) | Malpractice payments, adverse actions |
| State medical board | Disciplinary actions, complaints |
| OIG exclusion list | Exclusion from federal programs |
| SAM.gov | Federal debarment |
| State Medicaid exclusion | State-specific exclusions |
Red flags: Any NPDB reports, OIG exclusions (deal-breaker), pending investigations, pattern of malpractice claims.
5. CME and Competency Documentation
| Item | Verify |
|---|---|
| CME completion records | Meets all state requirements |
| Mandatory topic compliance | State-specific required topics completed |
| Documentation availability | Certificates organized and accessible |
| Audit history | Any past CME audits and results |
Red flags: Incomplete CME documentation, missing mandatory topics, reliance on provider attestation without verification.
6. Malpractice Insurance
| Item | Verify |
|---|---|
| Current coverage | Policy active, limits adequate |
| Claims history | Open claims, settlements, judgments |
| Tail coverage | Who pays for tail if claims-made policy |
| Coverage limits | Meets state minimums and hospital requirements |
Red flags: Claims-made policy without tail coverage clarity, coverage gaps, limits below standard.
7. Facility and Practice Credentials
| Item | Verify |
|---|---|
| State facility license | If required, verify active status |
| CLIA certification | If lab services performed |
| Accreditation status | AAAHC, Joint Commission if applicable |
| Medicare certification | For facility billing |
Red flags: Expired certifications, pending surveys with deficiencies, conditional accreditation.
Post-Acquisition Credentialing Considerations
What Changes with Ownership
Healthcare providers and facilities must have appropriate licenses and credentials to operate legally. Mergers or acquisitions may require updates or adjustments to existing licenses and credentials:
- Medicare/Medicaid: Ownership changes require updated enrollment applications
- State licenses: Some states require notification of ownership changes
- Payer contracts: May require assignment or re-credentialing
- Hospital privileges: New ownership may trigger reappointment review
The Re-Credentialing Timeline
Plan for 90-180 days of credentialing work post-acquisition:
| Task | Timeline |
|---|---|
| Medicare enrollment updates | 60-90 days |
| Commercial payer notifications | 30-90 days |
| State license updates | Varies by state |
| New provider credentialing | 90-120 days |
Budget for Credentialing Remediation
If due diligence reveals credentialing gaps, budget for:
- Expedited credentialing services: $1,000-$5,000 per provider
- Legal review: If disciplinary issues exist
- Revenue delay: If providers can't bill immediately post-close
- Staff time: For remediation activities
Due Diligence Best Practices
Start Early
Credentialing verification takes time. Begin due diligence as soon as exclusivity is signed, not at the last minute before close.
Use Qualified Resources
Thorough due diligence is the foundation of successful compliance in healthcare M&A. This includes a comprehensive review of legal, financial, operational, and regulatory aspects. Engage specialists in healthcare law, finance, and operations who understand credentialing requirements.
Verify Primary Sources
Don't rely solely on seller representations. Conduct primary source verification of:
- License status (check state board websites directly)
- NPDB queries
- OIG/SAM exclusion checks
- Payer enrollment verification
Create Representations and Warranties
Include specific credentialing representations in the purchase agreement:
- All providers are properly licensed and credentialed
- No pending disciplinary actions
- No excluded individuals employed
- All CME requirements satisfied
- Payer enrollments are current and transferable
Plan for Integration
Post-acquisition monitoring is crucial for ensuring ongoing compliance. Develop a 100-day plan for credentialing integration that includes:
- Ownership change notifications
- System migrations
- Ongoing monitoring implementation
- Staff training on new processes
The Credentialing Red Flag Summary
Deal-Breakers
- OIG-excluded providers
- Revoked medical licenses
- Active fraud investigations
- Medicare/Medicaid exclusions
Significant Concerns (Price Adjustment)
- Multiple providers with license restrictions
- Pattern of malpractice claims
- Incomplete CME documentation
- Payer enrollment gaps
Manageable Issues (Remediation Plan)
- Licenses expiring soon (accelerate renewal)
- Minor documentation gaps (obtain before close)
- Single provider credentialing delay (plan around it)
Conclusion
Credentialing due diligence in healthcare M&A isn't optional—it's essential risk management. The practices you acquire bring their compliance history, their credentialing gaps, and their regulatory exposure. Discover these issues during due diligence, and you can negotiate price adjustments or remediation requirements. Discover them after close, and they're your problem to solve at your expense.
State laws dictate that medical professionals must maintain valid licenses and credentials. The new owner must ensure that all physicians, nurses, and staff meet state and federal regulatory requirements, including updated malpractice insurance, continuing education mandates, and DEA certifications.
A comprehensive credentialing due diligence process protects the acquirer, ensures continuity of care, and sets the foundation for successful integration. Skip it, and you're buying unknown risk.
Key Takeaways
- Verify all provider licenses: State licenses, DEA, controlled substance registrations
- Check disciplinary history: NPDB, OIG exclusion list, state boards
- Confirm payer enrollment: Medicare, Medicaid, commercial panels
- Review hospital privileges: Active status, scope, any restrictions
- Examine CME compliance: Documentation exists and meets requirements
- Plan for post-close: Ownership changes require credentialing updates
References
[1]: Holt Law - The Critical Role of Due Diligence in Healthcare Acquisitions https://djholtlaw.com/the-critical-role-of-due-diligence-in-healthcare-acquisitions/
[2]: Armanino - Healthcare Merger Acquisition Due Diligence https://www.armanino.com/articles/healthcare-merger-acquisition-due-diligence/
[3]: Riddle Compliance - Managing Compliance in Healthcare Mergers and Acquisitions https://riddlecompliance.com/managing-compliance-in-healthcare-mergers-and-acquisitions/
[4]: DealRoom - Healthcare Due Diligence https://dealroom.net/blog/healthcare-due-diligence