What credentialing gaps look like with healthcare suppliers
Vendor credentialing is the process of collecting, verifying and keeping current the licenses, insurance, certifications and exclusion checks a supplier needs before and while it does business with a healthcare organization.
Healthcare buys from suppliers that carry regulatory weight: drug wholesalers with state licenses, biomedical service firms with calibration certificates, lab courier companies, waste haulers, staffing agencies and IT vendors handling patient data under a business associate agreement. Each one has documents that expire on a different date. The OIG advises providers to check its exclusion list monthly, and warns that relying on a contractor to do the screening does not remove the provider's own liability.[1]
The gap rarely comes from a bad decision. A diagnostics lab onboards a new courier with a full file in January. The certificate of insurance expires in October and the renewal lands in a former coordinator's inbox. A fertility clinic's cryostorage service vendor renews its accreditation, but the old certificate is still the one on the shared drive. Nobody notices until a surveyor asks to see it.
Procurement Head
Owns the vendor list but cannot say which suppliers have a lapsed document today.
"I know we had it at onboarding. I don't know if it's current."Compliance Officer
Has to prove at audit time that every vendor was checked, with dates and evidence.
"Show me the check, not the policy."CFO / Finance Leader
Carries the financial exposure if payments go to an excluded or unlicensed supplier.
"Are we paying anyone we shouldn't be?"Department Manager
Relies on a trusted vendor and sees document requests as paperwork that slows the work down.
"They've serviced our equipment for years. What's the problem?"Do stale supplier documents put your organization at risk?
Tick every statement that is true today. Three or more means the problem is likely costing you real money.
Six reasons supplier credentials lapse unnoticed
Stale documents are a symptom. These are the process gaps behind them that we see most often in clinic, lab and hospital networks.
Documents are collected once and never tracked
Onboarding gathers the file, but expiry dates are never recorded as data, so there is nothing to trigger a renewal request.
No single owner for each supplier's file
Procurement assumes compliance is watching, compliance assumes the department is, and the department assumes procurement handled it.
Every supplier gets the same checks
Without risk tiers, teams spend effort on low-risk office suppliers while a drug wholesaler or clinical service vendor gets the same light touch.
Buying is not connected to compliance status
A vendor with an expired license can still receive a PO and a payment, because the purchasing system does not know the document lapsed.
Renewal requests depend on manual chasing
Coordinators email suppliers one by one, replies arrive in personal inboxes, and new certificates are saved wherever is convenient.
Trusted relationships bypass the process
Long-standing vendors that departments like are the least likely to be asked for updated paperwork, and the most likely to have gaps.
What a lapsed supplier credential can cost
The largest exposure comes from paying for items or services furnished by an excluded party, where federal penalties are set per item.
The direct costs are penalties, repayments and the cost of replacing a supplier at short notice when a lapse is found. The indirect costs are often larger: staff days spent assembling evidence before a survey or audit, services paused while a vendor's paperwork is fixed, findings that reach your board or payers, and the insurance gap if an uninsured contractor causes damage on site.
Estimate the manual cost of keeping documents current
Enter your figures. Nothing is stored or sent anywhere.
The expert playbook: six practices that keep supplier credentials current
These practices work with a spreadsheet to begin with. Start with a clean register, then tier, then connect compliance status to buying so gaps cannot quietly continue.
"Every provider has a vendor the business team loves whose documentation is a mess. Nobody acts, because the service is good, until something goes wrong and the file is empty. The fix is not a stricter policy. It is making the current document part of how that vendor gets a PO, so compliance happens on the way to buying."Md. Kafil, Co-founder and CEO, Zapro. Former senior product specialist on SAP Ariba Network and procurement transformation manager at KPMG.
Build one register with an expiry date on every document
Tier suppliers by regulatory and patient risk
Screen exclusion lists on a fixed monthly cycle
Request renewals 60 days before expiry
Connect compliance status to purchasing and payment
Keep audit evidence as you go
"At Voonik we ran annual re-verification for around 15,000 suppliers, and I saw hundreds frozen over a single missing document. That taught me two things. Tell suppliers early and clearly what is expiring, and give them one place to upload it. Most lapses are not suppliers refusing. They simply never got a clear request."Daniel Sagayaraj, Co-founder and CTO, Zapro. Previously built and ran supplier onboarding and payments for a 15,000-supplier marketplace at Voonik.
How Zapro keeps supplier compliance current without the chasing
Zapro keeps each supplier's documents, contracts, conversations and compliance status in one vendor profile, and links that profile to purchasing, so a lapse is visible before the next order goes out.
| Root cause | Zapro capability | What changes |
|---|---|---|
| Documents collected once and never tracked | Vendor Management: onboarding templates and centralized profiles | Every supplier onboards through the same template, and documents live on one profile instead of in inboxes. |
| Manual renewal chasing | Vendor Management: compliance monitoring | Compliance status is monitored across the vendor base, and documents and conversations stay together on the supplier record. |
| Agreements and BAAs expire unseen | Contract Management: alerts before renewals or expiries | Contracts and agreements sit in one repository with version tracking and alerts before they expire. |
| Buying not connected to compliance | Procurement: approval workflows and role-based access | Requests and POs run through defined approvals, so a vendor's status can be checked before an order is released. |
| Vendor data out of sync with finance | Integrations: two-way ERP and accounting sync | Vendor master data stays aligned between Zapro and your ERP, so AP and procurement work from the same supplier record. |
Zapro syncs vendor and master data both ways with your ERP or accounting system, and keeps a full audit trail of approvals and changes with granular role permissions. See Zapro integrations and Zapro for Healthcare.
A 30, 60, 90 day plan
Days 1 to 30: Inventory it
- List every active vendor paid in 12 months
- Define three risk tiers and required documents
- Record expiry dates for top-tier vendors
- Run a full exclusion screen and save results
Days 31 to 60: Close it
- Request all missing or expired documents
- Assign a named owner to each top-tier vendor
- Set 60, 30 and 14 day renewal reminders
- Start monthly exclusion screening
Days 61 to 90: Lock it in
- Flag lapsed vendors at the PO step
- Extend the register to lower tiers
- Run a ten-vendor audit sample test
- Report credentialing status to leadership
KPIs to track progress
| KPI | How to calculate | Review |
|---|---|---|
| Vendor credential coverage | Active vendors with all required documents current divided by active vendors | Monthly, by tier |
| Documents expiring in 60 days | Count of required documents with an expiry date in the next 60 days | Weekly |
| Lapsed document count | Required documents past expiry with no renewal on file | Weekly |
| Exclusion screening currency | Active vendors screened in the last 30 days divided by active vendors | Monthly |
| On-time renewal rate | Documents renewed before expiry divided by documents due | Monthly |
| Spend with non-compliant vendors | PO or invoice value with vendors missing a required current document | Monthly |
Go deeper with our guide to vendor management systems.
What a Zapro customer saw after moving this work into one workflow
"Zapro made procurement effortless with a user-friendly interface and stellar support. Our team and suppliers adapted quickly, and we're now seeing faster approvals and smoother collaboration."Maria Rowan, Business Controller, Repromed
Why Zapro for this challenge
Credentialing gaps happen because supplier documents are tracked apart from the buying that depends on them. Zapro puts both in one vendor record, so the renewal is requested early and the lapse is seen before the next order.
Built around the vendor relationship
Documents, contracts, conversations and performance sit on one supplier profile across its full lifecycle.
Compliance and purchasing in one place
The same platform runs requests, approvals and POs, so vendor status is present when money is committed.
Audit-ready by default
A full audit trail of approvals and changes, with role-based permissions, means evidence is kept as work happens.
Sized for provider networks
Spark covers up to 50 vendors and Growth up to 500, with unlimited users on every plan.
When Zapro may not be the right fit
- You need clinical credentialing of physicians and nurses for medical staff privileges. That is a separate process with dedicated systems.
- You need a hospital vendor representative access system that badges reps in and out of clinical areas. Zapro manages supplier companies, not visitor check-in.
- You work with a handful of suppliers and a calendar reminder for each document already keeps you current.
Frequently asked questions
What is vendor credentialing in healthcare?
It is the process of collecting and verifying the documents a supplier needs to do business with a provider, such as state licenses, certificates of insurance, accreditations, business associate agreements and exclusion list checks, and keeping them current for as long as the relationship lasts.
How often should we screen vendors against exclusion lists?
The OIG has advised providers to check its exclusion list monthly. Many organizations also screen relevant state Medicaid exclusion lists on the same cycle. Keep the date and result of each check, because evidence of the screening matters as much as the screening itself at audit time.
Which supplier documents expire most often?
Certificates of insurance usually renew every year and are the most common gap. State licenses for drug wholesalers and pharmacies, accreditation certificates, calibration or service certifications and data security attestations also expire on their own schedules, which is why a register with dates matters.
Is vendor credentialing the same as vendor rep credentialing?
No. Vendor rep credentialing controls which sales and clinical representatives can enter a hospital's patient areas, usually through a badge system. Supplier credentialing covers the company itself: its licenses, insurance, contracts and compliance status.
Can a spreadsheet handle supplier credentialing?
For a small vendor base, yes, if every document has an expiry date and someone reviews it weekly. It breaks down with hundreds of vendors, several sites and staff turnover. Tools such as Zapro help at that point by sending renewal alerts and linking vendor status to purchasing.
About the experts behind this page
Sources
Editorial note: this page is published by Zapro, which sells procurement software. Best practices are written to work with any tool, and figures are cited to their original publishers. Last reviewed 29 September 2026; next review due March 2027. See how the Procurement Challenges Directory is researched and reviewed.