Credential Expiration and Compliance: Two Clocks, One Dashboard
Healthcare organizations run on two compliance clocks, and most organizations only track one of them.
The first clock is training renewal: annual HIPAA, cybersecurity, and other certifications that expire on a calendar cycle. This is the one most compliance programs were built to track.
The second clock is credential expiration: DEA registrations, state medical and nursing licenses, board certifications, COI renewals, CAQH re-attestations. These run on their own schedules — some annual, some biennial, some tied to a specific credential type — and they don’t align with your training calendar.
When the second clock lapses, the consequences are different in kind, not just degree.
What happens when a DEA registration lapses
A DEA registration lapse is not a paperwork problem. A provider without a valid DEA registration cannot legally prescribe controlled substances. In a practice where controlled substances are part of any care pathway, a lapse creates immediate clinical liability — not a compliance finding to address at the next audit, but a gap that affects care delivery on the day it lapses.
The window between “expiring soon” and “lapsed” is small. DEA registrations renew every three years, which means they don’t cross your field of vision every year. The risk is exactly the renewals that are easy to miss because they don’t show up often.
What happens when a state license lapses
A state medical or nursing license lapse is a different kind of problem. Practicing without a valid license is practicing unlicensed — in most states, a criminal matter, not merely a regulatory one. For the organization, it’s a credentialing failure with downstream liability: payers who learn a provider was practicing on a lapsed license have grounds to recoup payments.
The lapse often doesn’t surface until someone checks: a payer audit, a credentialing update cycle, or a complaint. By then, the gap has a history.
What happens when a CAQH attestation lapses
CAQH re-attestation is required quarterly (or as required by participating payers) to keep a provider’s information current. A lapsed CAQH profile isn’t a regulatory violation, but it creates downstream friction: payer enrollment updates stall, credentialing requests take longer, and in some cases a lapsed profile results in a provider being flagged as inactive.
For credentialing staff, CAQH maintenance is a steady-state task that can easily slip when someone is focused on a new enrollment. Automated alerts change the default from “catch it when it breaks” to “catch it before it does.”
Two clocks, one dashboard
The cleanest solution is not two separate systems — one for training, one for credentials — that someone has to reconcile manually. It’s a single system that tracks both, clearly separated.
LaborGenie tracks external credentials alongside platform training records, with 90, 60, and 30-day alerts before anything lapses. The records are kept clearly separate:
- Platform training records — module completions, quiz scores, signed attestations, curriculum version hashes. Platform-attested.
- Tracked external credentials — state licenses, DEA registrations, board certifications, COI, CAQH. Recorded as claims with document evidence. Never platform-verified, never entering the signed attestation chain.
The distinction matters: a self-reported credential and a platform-verified training completion are different things. A system that blends them presents a false picture. The separation is deliberate, and the honesty of it is a selling point.
Who manages what
LaborGenie splits credential management between admins and individuals:
- Admins add and update credentials on the person’s profile, track expiration dates, and receive the 90/60/30 alerts on the admin dashboard and in the monthly compliance digest
- Employees maintain their own through their personal dashboard — uploading document copies, updating dates, flagging changes
Document copies upload to storage behind a login-gated route. They’re attached to the person record, not to a separate file share or email thread.
The monthly digest
On the first of each month, admins and security officials receive a compliance digest: who is due for a training renewal, who has credentials expiring in the next 90 days, and where the team’s current completion state stands.
This is not a screenshot from a dashboard. It’s a structured summary that makes the compliance state reviewable by the people responsible for it — without requiring them to log in and run a report.
See how it works
If you’re currently tracking credentials in a spreadsheet, a tickler system, or a separate credentialing platform that doesn’t talk to your training records, book a short call to see what a unified system looks like in practice.