Credentialing at Scale: What Managing 820,000+ Providers Reveals About Industry-Wide Blind Spots

A Number That Should Reframe How You Think About Your Roster

We monitor just over 820,000 provider records across 217,810 practices. Last week alone, our pipeline flagged 857 delta events: address changes, taxonomy updates, license status shifts, things that had been true in a credentialing system and quietly stopped being true at the source. That's in one week.

That cadence is what scale reveals. And what it reveals, mostly, is that individual practices are flying blind in ways they can't see from inside their own four walls.

This post is about the specific patterns we keep finding, why they matter, and what they mean for how a practice manager or credentialing professional should be thinking about their audit priorities right now.

The Structural Blind Spot Nobody Talks About

The credentialing industry has a design flaw baked into its original architecture. Credentials get verified at hire or at initial credentialing, and then again at the two-to-three-year recredentialing cycle. Everything in between is, largely, hope.

Verisys flagged this about three weeks ago as an industry-wide structural problem, and they're right. Between verification events, licenses lapse, board actions happen, addresses change, and taxonomy codes drift. The credentialing record says everything is fine because the credentialing record doesn't update itself.

NCQA's 2025 standards were partly a response to this. The cornerstone change, finalized in August 2024 after nearly 1,500 comments from 65 organizations, is mandatory monthly monitoring across license status, OIG exclusions, disciplinary actions, and SAM.gov debarment checks (Medwave, October 2025). That's a meaningful shift from periodic to continuous, and it signals where the regulatory direction is heading.

The REAL Health Providers Act, signed February 3, 2026 as part of the Consolidated Appropriations Act, accelerated that direction further. For Medicare Advantage plans, it introduces 90-day proactive verification requirements for every provider record starting plan year 2028, a five-business-day removal requirement when a provider leaves network, and a three-tier penalty structure that includes directory suppression during Annual Enrollment Period, cost-sharing liability for misdirected members, and public accuracy score exposure beginning in 2029 (Atlas Systems, March 2026).

The regulatory environment has structurally changed. The question is whether your monitoring cadence has.

What the Data Actually Shows: Three Drift Patterns at Scale

When you monitor 820,000 providers continuously, certain discrepancy types cluster in predictable ways. Here is what I keep seeing.

Address mismatches are the most common. Practices move, satellite offices open and close, billing addresses change independently of practice addresses, and none of it propagates automatically to payer directories or credentialing records. This feels like a housekeeping problem until you realize that a stale address is a denied claim trigger in some payer systems and a licensing compliance flag in certain state boards that tie license validity to practice location. In our pipeline, address-related discrepancies show up on roughly 5.5% of practices we monitor, which translates to about 12,000 practices with at least one active mismatch right now.

Taxonomy code drift is more subtle and arguably more dangerous. A provider gets credentialed under a primary taxonomy code that reflects their specialty at time of hire. Over time, their practice focus shifts, maybe toward a subspecialty, maybe into a different care setting. The taxonomy code in the credentialing record doesn't update because nobody is watching it. When claims start coming through under a code that doesn't match the credentialing record, you have a payer audit conversation you did not see coming. We catch these during our NPPES delta scans, which run weekly.

Licensure lapses are the one that drives the most urgency. Neolytix published in May 2026 that credential lapse rates run between 3 and 7% annually in large provider networks without automated monitoring. Scale that to a 30-provider practice and you're looking at 1 to 2 providers at risk in any given year. Scale it to a hospital with 800 credentialed providers and you're potentially looking at 24 to 56 people practicing with credentials that need attention. The lapse doesn't have to be dramatic. A renewal missed by 30 days, a CE requirement not logged, a DEA registration expired. Small things become big things when a claim gets denied or an audit arrives.

Why Individual Practices Can't See This Alone

Here is the honest answer to why these patterns persist: you cannot see your blind spots from inside them.

A practice with 15 providers running annual audits does not have a comparison class. They do not know whether their 2% mismatch rate is normal or alarming because they have never seen a distribution. They do not know whether their taxonomy codes are drifting because there is no external benchmark telling them what drift looks like.

This is what scale actually provides. When you are watching 820,000 records across 217,000+ practices, patterns become visible that are genuinely invisible from inside any single organization. The 857 delta events we flagged last week are not anomalies. They are the expected rate of change across a live provider population.

The research corroborates this. A small payer managing 10,000 providers manually spends over $300,000 annually on directory verification. A larger payer can spend over $22 million (Concentrix, 2026). The cost of not knowing is already priced into most organizations' operations. They just don't categorize it that way.

False Claims Act enforcement reaching its highest single-year total in history in 2025, with DOJ explicitly calling out stale provider data as a contributing root cause in several focus areas (Foley and Lardner, March 2026), adds a different kind of cost: the one that shows up in settlement agreements.

What Argoseer Does Here, and What It Doesn't

Argoseer monitors provider records against primary source data: NPPES, state license boards, OIG exclusion lists, SAM.gov, and payer directories, running delta detection on a weekly cadence with daily flagging for high-priority events like active exclusions or license expirations within 60 days. When a discrepancy surfaces, we surface it as a structured alert tied to the specific provider record, with the before-state and the current-state so your credentialing team has something actionable, not just a notification.

We work alongside your existing credentialing stack. If you are using CAQH, Medallion, Modio, or Symplr, Argoseer is not replacing any of that. Your credentialing system tracks what you filed. We verify whether it is still true. That distinction matters: we are not a CVO, we do not perform NCQA primary source verification, and we do not issue licenses or guarantee license validity. We flag discrepancies between what your records say and what the sources say today.

For practice managers with smaller rosters, the practical value is that you get access to the same signal that large networks have been paying millions of dollars to approximate, without having to build the monitoring infrastructure yourself.

Your Next Audit Priority List

If you are a practice manager or credentialing professional reading this and wondering where to start, here is what the data suggests: run address verification first, because it is the highest-volume discrepancy and the easiest to correct. Then check taxonomy codes against NPPES for any provider whose practice focus has shifted in the last two years. Then pull your license expiration calendar and ask honestly whether you would catch a 30-day lapse before a payer would.

That last question is really the one. The industry has spent decades answering it with periodic audits and manual checks. The regulatory environment in 2025 and 2026 is asking for something different.

See how Argoseer fits into your monitoring workflow at argoseer.com/product/monitor.