What Does It Mean to Be Paneled With Insurance?
Credentialing, contracting, CAQH, private pay, and the fine print nobody explains
Being “paneled” with insurance sounds deceptively simple.
You submit an application. Someone checks your license. A contract appears. You sign it. Patients use their insurance. Everyone gets paid. We all go home at a reasonable hour.
That is adorable.
In reality, insurance participation involves several different processes—credentialing, contracting, enrollment, affiliation, and billing configuration—that people routinely collapse into one word. Then everyone is surprised when the provider has a CAQH profile, a signed agreement, and six denied claims because the payer never loaded the correct location or tax ID.
This is one of the questions I am asked most often:
If I—or my private practice—become credentialed, do I have to accept insurance for everyone? Can some providers remain private pay? Can a patient choose not to use insurance? Does joining one panel mean the entire practice loses the ability to set private rates?
The short answer is no, credentialing by itself does not force an individual or practice to accept insurance.
The more accurate answer is: it depends on what has been credentialed, what has been contracted, which payer product is involved, which tax ID and location are attached, whether the clinician has been linked to the group, what the participation agreement requires, and whether Medicare or Medicaid rules apply.
Insurance loves a simple answer almost as much as it loves answering the phone on the first call.
This article provides a national overview for U.S. private practices. Payer contracts, state laws, Medicaid programs, professional licensing rules, and benefit plans vary. Treat this as education—not legal advice or a substitute for reviewing the actual agreement.
First: the words do not mean the same thing
Before deciding whether to accept insurance, it helps to separate five processes that are frequently—and incorrectly—used interchangeably.
The distinction matters because a clinician may be:
fully credentialed but not contracted;
contracted but not yet loaded into the payer’s claims system;
active individually but not affiliated with the new group;
in-network for one product but out-of-network for another product sold by the same insurance company; or
listed in a directory while claims are still denying because insurance systems are apparently allowed to have a sense of humor.
Payers themselves acknowledge that these are separate stages. For example, UnitedHealthcare explains that credentialing and contracting must both be complete and that the provider should wait for written confirmation of the network effective date before treating members as in-network. Aetna similarly separates its network-needs review, contracting, credentialing, and final effective-date process. See UnitedHealthcare’s network-participation guidance and Aetna’s network application process.
The rule worth taping above your desk
Do not treat a provider as in-network until you have the payer’s written approval and effective date for the correct clinician, group, tax ID, location, and product.
A completed CAQH profile is not an effective date. A submitted application is not an effective date. A friendly representative saying, “Everything looks good on our end,” is definitely not an effective date.
What does it mean to be “in-network”?
An in-network—or participating—provider has a contract with a health plan and agrees to follow its terms. CMS defines a preferred provider as an individual or facility that has contracted with a plan and notes that a network provider generally may not balance bill a member for covered services. The patient typically owes only the plan-defined deductible, copayment, coinsurance, or other permitted responsibility. See CMS’s health-insurance terms.
The participation agreement commonly addresses:
which products are included;
the contracted fee schedule or reimbursement methodology;
claim-submission deadlines;
prior-authorization and medical-necessity requirements;
documentation and record-access obligations;
provider-directory accuracy;
coordination of benefits;
member cost-sharing and balance-billing restrictions;
audits, overpayments, and recoupments;
dispute and appeal procedures;
credentialing and recredentialing requirements; and
how either party may terminate the agreement.
Being contracted with the insurance company’s commercial PPO does not automatically mean you participate in its HMO, Marketplace, Medicare Advantage, Medicaid managed-care, or employer-specific networks. The logo on the insurance card is not enough. The exact product matters.
What are the benefits of joining insurance panels?
1. More people can realistically afford your services
Even when deductibles and copayments remain substantial, using insurance may make ongoing care financially possible for clients who could not sustain a full private-pay rate.
2. Your referral pool may become significantly larger
Patients, primary-care providers, hospitals, EAPs, discharge planners, and other referral sources frequently begin their search with the insurance directory. Network participation can place a practice in front of people who would not otherwise find it.
3. It may produce a steadier flow of inquiries
A full private-pay practice can be successful, but it usually requires stronger direct marketing, reputation, specialization, and referral relationships. Insurance participation can reduce some of that friction—although it does not guarantee that the phone will ring or that the patients will be appropriate for your services.
4. It can support continuity of care
Clients may be more likely to remain in treatment when the cost is shared with their plan. That matters in behavioral health, where improvement often requires more than three sessions and a worksheet.
5. It can support organizational growth
For group practices, panel participation may support recruiting, referral partnerships, program development, and more predictable demand. It may also make the organization more attractive to hospitals, employers, schools, and other partners that need in-network referral options.
What are the disadvantages?
1. You do not control the entire price
An in-network provider generally agrees to the payer’s allowed amount for covered services. If your standard rate is $180 and the allowed amount is $112, you normally cannot bill the member the remaining $68 simply because you would prefer the other number.
2. Getting paid requires an administrative system
Eligibility, benefits, authorizations, coding, claim submission, clearinghouse edits, denials, corrected claims, appeals, payment posting, secondary claims, patient balances, and follow-up all require ownership.
Credentialing gets you onto the panel. It does not make your claims clean, your documentation compliant, or your accounts receivable magically behave.
3. Payment is delayed
Private pay may be collected at or before the visit. Insurance reimbursement arrives after the service—assuming the claim is clean, the eligibility was correct, the authorization existed, the payer loaded the provider correctly, and Mercury was apparently not in retrograde.
4. The payer may review or recoup payment
Contracts generally permit audits, medical-necessity review, overpayment recovery, and recoupment. Money received is not always money permanently retained.
5. Administrative work can consume clinical capacity
The provider may not personally submit claims, but someone must manage the system. If nobody clearly owns credentialing and revenue-cycle follow-up, the work usually lands on the clinician between sessions—which is a very expensive way to discover an expired CAQH attestation.
6. Network access is not guaranteed
Submitting an application does not obligate a payer to accept it. Payers may evaluate whether their network needs another clinician of that specialty in that geographic area. Aetna, for example, states that it reviews network need before beginning contracting. Being fully qualified and being admitted to the network are separate questions.
What is CAQH?
CAQH is the name most providers still use for the centralized provider-data system now presented as the Provider Data Portal through DataSpring, formerly CAQH.
The portal allows clinicians and authorized group administrators to enter professional and practice information once and share it with designated health plans. DataSpring reports that more than 2.5 million providers use the portal and describes it as a single credentialing application supported across all 50 states. See DataSpring’s credentialing overview and Provider Data Portal resources.
A CAQH profile commonly includes:
legal name and demographic information;
individual NPI and taxonomy;
professional licenses;
education and training;
specialty and board certification, when applicable;
work history and explanations for gaps;
practice locations and hours;
hospital affiliations or admitting arrangements, when applicable;
DEA or controlled-substance registrations, when applicable;
professional liability insurance;
disclosure questions;
sanctions or adverse actions;
Medicare and Medicaid participation information;
group tax ID and billing details;
supporting documents; and
authorization identifying which payers may access the profile.
What CAQH does not do
CAQH does not:
issue an NPI;
grant a professional license;
decide whether a payer’s network is open;
negotiate or sign your contract;
set your reimbursement rate;
enroll your group in every payer product;
link every clinician to your tax ID; or
make you in-network simply because the profile says “complete.”
CAQH stores and shares the information. The payer still makes its own credentialing and contracting decision.
Providers generally must periodically review and re-attest that their information is accurate. DataSpring states that the standard attestation requirement remains every 120 days, with an exception for Illinois providers. Put the deadline on a recurring calendar. “I thought CAQH would remind me” is a sentence that has preceded many stalled applications.
Who should control the profile?
The individual provider should retain ownership of and access to their professional profile. A group administrator may be authorized to maintain it, upload documents, and manage payer authorizations, but the practice should not create a system in which a departing clinician is locked out of their own credentialing history.
How an individual provider becomes paneled
The exact order varies by payer, and some steps run simultaneously. A typical commercial process looks like this:
Step 1: Establish the provider’s professional identity
The clinician generally needs:
an active, unrestricted professional license for the state of practice;
an individual Type 1 NPI;
the correct taxonomy code;
current professional liability coverage;
a complete résumé or CV;
education, training, and specialty information;
controlled-substance registrations when relevant; and
accurate practice locations, contact information, and availability.
CMS explains that the NPI is a unique 10-digit identifier used in standard healthcare transactions. An individual receives a Type 1 NPI; an eligible healthcare organization may receive a Type 2 NPI. Importantly, CMS also warns that receiving an NPI does not prove that the provider is licensed or credentialed. See CMS’s NPI guidance.
Step 2: Complete and attest the CAQH profile
Every section must match the source documents and payer application. Differences in names, addresses, suite numbers, tax IDs, license dates, or malpractice coverage can delay the process.
The provider must also authorize the applicable payer to access the profile. A perfect CAQH application that the payer cannot view is simply a beautifully completed secret.
Step 3: Request participation from the payer
The provider or group submits the payer’s participation request for the correct specialty, state, service location, tax ID, and products.
The payer may:
accept the application;
decline because the network is closed;
request additional information;
redirect behavioral-health credentialing to a separate vendor; or
offer participation in only certain products.
Step 4: Complete credentialing verification
The payer or its credentialing verification organization may verify:
licensure;
education and training;
board or specialty status;
malpractice coverage and claims history;
work history and unexplained gaps;
federal and state exclusions;
disciplinary actions;
adverse legal or professional disclosures; and
identity, NPI, taxonomy, and location information.
The completed file may then go to a credentialing committee for approval.
Step 5: Review and execute the contract
Read the actual participation agreement and fee schedule. Important questions include:
Which products are included?
Is participation required at every location or tax ID?
Must all eligible clinicians in the group participate?
Are claims required for all covered services provided to members?
What are the timely-filing limits?
What are the authorization rules?
Can the payer unilaterally amend the fee schedule?
What are the audit and recoupment provisions?
What notice is required to terminate?
Contracting may occur before, during, or after credentialing depending on the payer.
Step 6: Link the clinician to the correct group and tax ID
For group billing, the payer must associate the rendering clinician’s Type 1 NPI with the organization’s Type 2 NPI, tax ID, locations, and contract. This may be called affiliation, reassignment, provider loading, or roster enrollment.
Step 7: Obtain the written effective date
Confirm in writing:
the individual provider;
group or billing entity;
tax ID;
service location;
payer products;
provider or contract identifiers; and
effective date.
Do not assume the payer will retroactively cover services. Do not assume a representative’s verbal approval will survive a denied-claim appeal.
Step 8: Configure billing
The practice must still set up:
electronic claims or clearinghouse enrollment;
electronic remittance advice;
electronic funds transfer;
payer IDs;
provider and group identifiers;
fee schedules;
place-of-service and taxonomy configuration;
eligibility and benefit workflows;
authorization tracking; and
denial and follow-up ownership.
Step 9: Maintain the panel
Paneling is not a one-time craft project. Licenses, malpractice policies, addresses, rosters, ownership, bank information, CAQH attestations, payer directories, and recredentialing requirements must remain current.
How a private practice or group becomes credentialed
When someone says, “The practice is credentialed,” they may mean several different things.
For a standard professional group practice, the organization is typically contracted and enrolled as a billing entity, while each rendering clinician is individually credentialed and formally affiliated with the group.
The organization generally needs
a legally established business entity;
an EIN or tax identification number;
a W-9 matching the legal name and tax ID;
a Type 2 organizational NPI;
correct organizational taxonomy codes;
ownership and controlling-interest disclosures;
service and pay-to addresses;
business, professional, or facility licenses when required;
general and professional liability coverage;
banking information for EFT;
billing and clearinghouse information;
an authorized official;
a complete clinician roster; and
policies, accreditation, certification, or site documentation when required for the service type.
CMS identifies group practices and clinics as Entity Type 2 organization providers. For Medicare, clinics and group practices generally enroll through PECOS, and individual practitioners must be enrolled and reassign the right to payment to the organization. CMS describes reassignment as the mechanism that lets an eligible group submit claims and receive payment for Part B services furnished by the individual. See CMS’s Medicare enrollment guide and PECOS enrollment applications.
Every rendering clinician may still need individual approval
A group contract does not necessarily allow every licensed person in the building to bill immediately. Each clinician who falls within the payer’s credentialing requirements generally must:
maintain their individual professional credentials;
complete their CAQH or payer application;
receive credentialing approval;
be added to the group’s contract or roster;
be loaded under the correct location and tax ID; and
receive an effective date.
Billing under another clinician’s NPI merely because the new provider is “still pending” is generally not an acceptable shortcut unless the payer has a specific, written rule permitting that billing arrangement. The fact that the software allows an NPI to be entered does not make the claim compliant.
Group practice versus facility credentialing
A private psychotherapy group billing professional services is not the same as a licensed facility or organized treatment program.
An IOP, PHP, residential program, opioid treatment program, hospital, or other facility may face additional requirements involving:
state facility licensure;
accreditation;
ownership and financial disclosures;
program descriptions;
staffing standards;
site reviews;
Medicare or Medicaid certification;
facility-specific contracts;
institutional claims; and
separate organizational credentialing.
Do not assume that successfully paneling individual therapists automatically credentials a facility-level program—or that a facility contract automatically authorizes every professional service.
If the practice becomes credentialed, does it have to accept insurance?
Credentialing alone: generally, no
Credentialing is verification. It does not, by itself, create an obligation to treat members or submit claims.
A signed participation agreement with an active effective date: usually, yes—for the services and members covered by that agreement
Once the practice or clinician becomes an active participating provider, the contract generally requires compliance with network rules. That often includes submitting claims for covered services, accepting the allowed amount, collecting only permitted member responsibility, and avoiding balance billing.
The exact obligation comes from the contract and applicable law—not from the existence of a CAQH profile.
Can the practice decline new insurance patients?
Often, a practice can close its schedule to new patients or limit capacity, but the contract may contain access, directory, continuity-of-care, notification, or nondiscrimination requirements. “In-network” does not necessarily mean “required to accept every new patient forever,” but a practice should not advertise availability it does not have or selectively apply access rules in a discriminatory manner.
Can some clinicians in the practice take insurance while others remain private pay?
Often, yes—but it must be intentionally structured.
A group may have:
paneled clinicians who bill selected insurance products;
clinicians still awaiting credentialing;
clinicians who are out-of-network with certain plans;
clinicians who provide non-covered services;
contractors who bill independently under a separate entity; or
private-pay clinicians whose services are not submitted through the group’s payer contracts.
However, the answer depends on:
whether the group agreement requires all eligible clinicians to participate;
whether the provider’s individual NPI has been affiliated with the group;
whether the contract applies across all locations or tax IDs;
whether the provider separately contracted with the same payer;
how the provider is represented in directories and marketing;
the provider’s employment or contractor agreement; and
Medicare, Medicaid, state-law, and professional-board requirements.
The practice may require an employed or contracted clinician to accept insurance as part of their job. That is an organizational and contractual expectation. It does not mean the clinician’s license automatically requires them to join insurance panels.
The worst arrangement is an ambiguous one: the website says the practice accepts the plan, scheduling assumes every clinician is covered, billing discovers otherwise six weeks later, and the patient receives the plot twist.
Create and maintain a payer-by-provider-by-location matrix. “We take Blue Cross” is not sufficient operational information.
Can an in-network provider still accept private pay?
Yes, private pay does not disappear—but it cannot be used casually to bypass a network agreement.
Private pay may be appropriate when
the patient has no insurance;
the patient knowingly chooses not to use commercial insurance;
the provider is out-of-network with that patient’s specific plan or product;
the service is not a covered benefit;
the service is outside the scope of the participation agreement;
the clinician practices separately under a different entity or location and the payer contract permits it; or
another specific payer or legal exception applies.
Private pay is not a safe shortcut when
the provider is in-network for the member and service but wants to avoid the contracted rate;
the provider wants to collect the difference between the standard rate and allowed amount;
the practice has not checked whether its contract requires claim submission;
staff represent the provider as out-of-network when the payer lists the provider as participating;
the practice attempts to bill under a different clinician while credentialing is pending; or
Medicare or Medicaid rules prohibit the proposed arrangement.
What if the patient chooses not to use commercial insurance?
Federal guidance recognizes that a person may choose not to use insurance and pay out of pocket. Under HIPAA, when an individual pays a covered entity in full for a particular service and requests that the related information not be disclosed to the health plan for payment or healthcare operations, the provider must generally honor that restriction unless disclosure is required by law. See the HHS HIPAA guidance.
That does not mean the front desk should simply click “self-pay” and move on with its day. The practice needs a written and reliable process to:
document the patient’s choice;
collect payment in full;
apply the HIPAA restriction correctly;
prevent an accidental claim or disclosure;
provide required cost information; and
check any Medicare, Medicaid, coordination-of-benefits, or contract-specific limitations.
When a person does not have insurance or chooses not to use it, the No Surprises Act generally requires a good faith estimate when care is requested or scheduled in advance. CMS also provides a patient-provider dispute process when a bill is at least $400 above the estimate. See CMS’s self-pay guidance.
Can the practice use a different private-pay rate?
A practice may establish private-pay rates, but it should apply them through a written fee policy and review:
payer-contract requirements;
state law;
Medicare and Medicaid restrictions;
good-faith-estimate obligations;
discount and financial-hardship policies;
documentation and nondiscrimination concerns; and
how the rate affects billing representations.
For an in-network, covered service submitted to the plan, the contracted allowed amount—not the practice’s preferred cash rate—normally controls the total collectible amount.
Medicare is not simply another commercial panel
Medicare uses distinct concepts: enrollment, participation, assignment, non-participation, reassignment, and opt-out.
CMS explains that a participating provider agrees to accept assignment for all Medicare-covered services and accepts the Medicare-allowed amount as payment in full, collecting only applicable deductible and coinsurance or copayment. A non-participating provider is not the same as an opted-out provider and remains subject to Medicare claim and charge rules. See CMS’s participation guidance.
Eligible physicians and practitioners who want private contracts with Medicare patients generally must formally opt out. CMS requires an opt-out affidavit and a private contract with each Medicare patient. The provider cannot opt out for only selected Medicare patients or selected services. CMS now lists eligible behavioral-health practitioners such as marriage and family therapists and mental health counselors among those who may opt out. See CMS’s opt-out requirements.
If your practice treats Medicare beneficiaries, do not use commercial-insurance logic and assume the same self-pay rules apply.
Medicaid requires even more caution
Medicaid is administered through state programs and managed-care organizations, so exact requirements vary. Federal rules tightly limit cost sharing for Medicaid members, and Medicare and Medicaid programs already contain protections against many forms of balance billing. See Medicaid’s cost-sharing overview and CMS’s billing-protection explanation.
Do not assume a Medicaid member may simply sign a generic private-pay form for a covered service. Before collecting private payment, verify:
the state Medicaid rules;
the managed-care contract;
whether the service is covered;
whether the provider is enrolled or required to enroll;
whether the member may legally agree to private payment;
required advance notices; and
whether nonpayment may affect access to the service.
This is an area where “the patient said it was fine” is not a compliance strategy.
A practical group-practice paneling workflow
If I were building this process for a private practice, I would organize it in the following order:
Phase 1: Decide what you are actually building
Define:
the states in which clinicians will practice;
provider types and license levels;
in-person and telehealth locations;
commercial, Medicare, Medicaid, EAP, and other target payers;
individual versus group billing;
professional versus facility services;
private-pay offerings; and
which clinicians should participate with each product.
Do not apply to every insurance company simply because its logo exists. Evaluate reimbursement, administrative burden, market demand, network status, authorization rules, and strategic fit.
Phase 2: Build the entity foundation
Obtain and validate:
legal entity records;
EIN/TIN;
W-9;
organizational Type 2 NPI;
taxonomies;
ownership information;
service and billing locations;
business and facility licenses;
insurance coverage;
bank and EFT documentation; and
authorized officials and delegated users.
Phase 3: Standardize provider files
Create one credentialing file for each clinician containing:
Type 1 NPI;
license and renewal dates;
CAQH ID and next attestation date;
CV and work-gap explanations;
education and training;
malpractice policy and expiration;
DEA or controlled-substance information when applicable;
taxonomy and specialties;
disclosure responses;
payer applications;
contracts;
effective dates;
provider IDs;
locations and products; and
recredentialing deadlines.
Phase 4: Apply, contract, and follow up
Track every payer and provider through:
participation request;
network-needs decision;
application submission;
CAQH authorization;
missing-information requests;
credentialing review;
contract negotiation and signature;
payer countersignature;
group affiliation or roster loading;
written effective date;
directory confirmation; and
billing-system activation.
Every open application should have a status, last-contact date, payer reference number, named owner, next action, and follow-up date.
“Pending” is not a status. Pending what, with whom, since when, and what happens next?
Phase 5: Validate before declaring victory
Before scheduling the provider as in-network:
verify the provider in the payer portal or directory;
confirm the tax ID and locations;
confirm every applicable product;
confirm the effective date in writing;
validate EDI, EFT, and ERA enrollment;
configure the fee schedule and payer ID;
submit and monitor initial claims; and
confirm that payment is attached to the correct provider and entity.
Credentialing is not complete because a contract has been placed in a folder titled “Credentialing—Done.” It is complete when the provider can correctly deliver, document, bill, and receive payment for the service under the expected agreement.
The questions every private practice should answer before joining a panel
Which exact payer products are included?
Is the network currently open for our specialty and location?
What are the reimbursement rates for our highest-volume services?
Which services require authorization?
What are the documentation and medical-necessity standards?
What are the timely-filing and appeal deadlines?
Does the agreement require all eligible clinicians or locations to participate?
Can clinicians maintain separate private-pay work under another entity or location?
When may a member choose not to use insurance?
How must non-covered services and self-pay arrangements be documented?
What are the payer’s audit and recoupment rights?
How may the payer change the fee schedule?
What are the termination and continuity-of-care requirements?
Who owns credentialing maintenance and roster updates?
Who works the claim after the first denial?
That final question matters more than people think. Submitting a claim is an activity. Collecting the money is the outcome.
The useful truth
Joining insurance panels can make care more accessible, expand a practice’s referral base, and create meaningful growth. It can also introduce lower reimbursement, delayed payment, administrative work, audits, denials, and contractual obligations that nobody fully appreciated when they clicked “sign.”
Credentialing is not inherently good or bad. Private pay is not inherently ethical or unethical. Insurance participation is a business and access decision that should be made deliberately, using actual rates, demand, administrative capacity, payer rules, and the needs of the population you serve.
The most important things to remember are:
CAQH is a data repository, not a network approval.
Credentialing verifies qualifications.
Contracting creates obligations.
Enrollment and affiliation make billing possible.
The written effective date determines when participation begins.
A group contract does not automatically activate every clinician.
Private pay may remain available, but it must be structured around contracts and applicable law.
Medicare and Medicaid require separate analysis.
Paneling is not finished until the claim can be correctly submitted, paid, posted, and reconciled.
And if all of this sounds like a lot of work, that is because it is.
Credentialing is often described as paperwork. It is really operational infrastructure. When it is handled well, providers spend more time caring for clients. When it is handled poorly, everyone spends three months forwarding the same email and wondering why the payer still has the provider listed at an address they left in 2019.
No one went into behavioral healthcare because they felt called to follow up on payer roster loading.
Unfortunately, someone still has to do it.
Frequently asked questions
Does having a CAQH profile mean I accept insurance?
No. It means your credentialing information is stored in a portal that authorized payers may access.
Does being credentialed mean I am in-network?
Not necessarily. You generally also need contracting, enrollment, any required group affiliation, and a written effective date.
Can a credentialed provider decide not to sign the contract?
Generally, yes. Credentialing approval and contract acceptance are separate decisions, although payer workflows vary.
Can an in-network provider charge a patient the full private rate?
Generally not for an in-network, covered service when the patient is using the plan. The participation agreement and balance-billing rules typically require acceptance of the allowed amount and collection of only permitted patient responsibility.
Can a commercially insured patient choose to self-pay?
Federal guidance recognizes that a patient may choose not to use insurance, but the practice needs a compliant self-pay, HIPAA-restriction, and good-faith-estimate workflow. Review the payer agreement and do not apply this answer automatically to Medicare or Medicaid.
Can one clinician be in-network while another clinician in the same practice is private pay?
Often, yes. The group agreement, provider roster, employment terms, directories, tax IDs, locations, and payer-specific rules must all accurately reflect the arrangement.
Can we bill under the owner while a new therapist is being credentialed?
Do not assume so. Use another provider’s NPI only when the payer and applicable billing rules expressly permit the arrangement and every requirement is satisfied.
How long does credentialing take?
There is no universal timeline. It depends on network need, payer workflow, application completeness, verification, contracting, committee review, and provider loading. Aetna indicates that its credentialing process may take approximately 45 days once underway, but that is one payer’s guidance—not an industry guarantee. Plan for follow-up and do not schedule based on a hoped-for date.
Does every provider need their own CAQH profile?
Each individually credentialed clinician generally needs an individual professional profile. An authorized practice administrator may help maintain it, but the provider should retain access and responsibility for attesting to its accuracy.
