Maryland HB 1093 Credentialing Law 2026: What to Do Now

Maryland's Credentialing Rules Are Changing This October: Here's What That Actually Means for Your Practice

If you run a practice in Maryland, or you're the person quietly holding together the credentialing files, the payer contracts, and the Medicaid enrollment spreadsheet nobody else wants to touch, you've probably caught wind of something happening this fall. It's not a rumor. It's real, and it's bigger than most of the emails about it let on.

Two things are converging on Maryland at almost the same time. A new state law rewrites how commercial carriers have to handle credentialing. Separately, Maryland Medicaid is retiring the enrollment portal it's used for years and moving everyone to something new. Either one on its own would be worth a planning meeting. Both at once, landing before October 1, 2026? That's worth an actual plan, not just a mental note.

Here's the thing, though: most of what's changing is genuinely good news. Faster decisions from carriers. No more application fees. One form instead of a different one for every single payer you deal with. The catch is that "good news" only holds up if your practice is already squared away when the switch happens. The practices that skip that step tend to find out the hard way, usually with a claim that bounces, or a new provider sitting around unable to see patients for a payer they're supposedly already credentialed with.

So let's get into it: what's actually changing, who it touches, and what to do about it before the deadline sneaks past you.

Why This Is Actually Worth Your Time

Talk to enough practice administrators in Maryland this year and you start hearing the same handful of questions on repeat. How long will credentialing actually take now? What happens to the application I already submitted? Is Medicaid going to stop paying me while they switch systems? Does CAQH even matter anymore?

None of these are theoretical. They're the kind of questions that show up as a real dent in cash flow 60 or 90 days later if the answer gets handled wrong, or not handled at all.

Credentialing delays are already one of the more common reasons a brand-new provider sits idle after being hired: fully able to see patients, unable to actually bill for it. Stack a statewide portal migration on top of that everyday friction, and the odds of something slipping through go up considerably.

Two Changes, One Deadline

Quick version before we go deep on each one.

First: House Bill 1093, effective October 1, 2026. It rewrites Maryland's credentialing statute, Insurance Article Section 15-112.1, so commercial carriers and their credentialing intermediaries have to rely on a single, state-designated uniform credentialing system as their primary source for provider directories. The law also shortens how long carriers get to make a credentialing decision, adds civil penalties when they blow past that window, and, this one's worth reading twice, bans carriers from charging providers application fees.

Second: Maryland Medicaid's move from ePREP to MPRIME (Maryland Provider Registration and Information Management Enterprise). Different law, different agency, same season. ePREP enrollment activity pauses in stages: moderate- and high-risk provider types first, limited-risk types shortly after, before the full cutover to MPRIME.

Neither of these is something you can just let happen around you. If you bill Medicaid, CareFirst, or basically any commercial payer in this state, one of these two changes is already sitting in your revenue cycle whether you've looked at it yet or not.

What HB 1093 Really Changes

Maryland already had a credentialing law on the books requiring carriers to accept a "uniform credentialing form" for both initial credentialing and recredentialing. HB 1093 doesn't invent that idea; it sharpens it. Here's what's actually different once October 1 hits.

One form, and carriers can't get creative about it. Under the existing regulation (COMAR 31.10.26.03), a carrier isn't allowed to make you modify the uniform form, tack on extra paperwork, or ask for information the form doesn't call for. HB 1093 reinforces that and gives the Insurance Commissioner more say over which systems actually qualify.
Application fees are gone. Carriers can no longer charge providers just to submit a credentialing application. If your billing spreadsheet has had a recurring line item for these fees across multiple payers, that number should start shrinking.
Carriers now have real deadlines, and real consequences for missing them. The law tightens how long a carrier has to notify a provider of a decision, and it introduces civil penalties for missing that window. The old penalty cap was pretty modest per violation. This version is clearly meant to make dragging your feet an actual compliance risk for the carrier, not just a headache for you.
The uniform system becomes what carriers build their directories from. That's the part people underestimate. If your information in that system is wrong, stale, or missing something, it doesn't just sit there quietly; it feeds straight into whether patients can even find you as in-network.
There's a narrow exception for hospitals and academic medical centers. If one of those is acting as a credentialing intermediary for practitioners with privileges there, the uniform-form requirement works a little differently. Most independent and group practices don't fall under this carve-out, so don't assume it applies to you just because your providers also have hospital privileges somewhere.

For the overwhelming majority of Maryland practices, private, group, or behavioral health, it doesn't matter, HB 1093 really comes down to one operational reality: your CAQH ProView profile and your record in the state-designated credentialing system need to be accurate, current, and consistent. Carriers are now required to lean on that data more than they used to, not less.

ePREP to MPRIME: The Medicaid Side

Completely separate from HB 1093, Maryland Medicaid is retiring ePREP, the portal it has used for a long time, in favor of MPRIME.

Here's the timeline worth putting on your actual calendar, not just skimming past:

July 1, 2026: ePREP application holds begin for moderate- and high-risk provider types.
August 1, 2026: holds extend to limited-risk provider types.
Applications are generally still accepted right up until the day before each hold date kicks in.
October 2026: MPRIME goes live, and ePREP stops being used for new applications or updates to existing enrollment.

A couple of Maryland-specific wrinkles worth knowing about:

Your SDAT ID matters more than it used to. Maryland Medicaid requires an active State Department of Assessments and Taxation identification number in good standing, structured correctly for your organization type. Individual billing providers specifically need theirs to start with the letter "L." No active, good-standing SDAT ID means no ability to submit applications once MPRIME takes over. If your practice's SDAT filing has quietly lapsed, and this happens more often than you'd think, especially for solo and small group practices, now is the time to sort it out, not after the switch.
"Shouldn't be disrupted" isn't the same as "won't be." Maryland Medicaid and its managed care partners have said, in various ways, that this transition isn't expected to interrupt current claims, payments, or provider data. That's reassuring, as far as it goes. But a migration this size always carries some risk, and the practices most likely to feel it are the ones with pending applications, recent ownership changes, or updates in flight during the actual transition window.
HealthChoice enrollment is two separate boxes to check, not one. Maryland's Medicaid managed care program requires providers to be enrolled both in the Managed Care Organization they contract with and in the traditional Fee-for-Service Medicaid program underneath it. It is an easy assumption to make, "I'm enrolled with the MCO, so I'm covered," and it is wrong often enough to be worth double-checking. Gaps here are a quiet, common source of denials that seem to come out of nowhere.

Who This Hits Hardest

Physicians and physician groups billing any commercial carrier in Maryland, plus Medicaid or HealthChoice, basically everyone.
Behavioral health and mental health providers. Psychiatry, psychology, counseling, substance use treatment, and ABA therapy: this group has historically dealt with some of the slowest credentialing turnaround in the state, so the shortened decision windows under HB 1093 should actually help more here than almost anywhere else.
Primary care practices, which may also start seeing more site evaluations tied to network participation reviews.
Specialists and procedural practices, particularly anyone contracting with CareFirst BlueCross BlueShield, given how much of Maryland's commercial market it holds.
Multi-state and telehealth groups expanding into Maryland, who now have to layer Maryland's specific rules on top of whatever their home state already requires of them.
Hospitals and academic medical centers acting as credentialing intermediaries get a narrower version of the rule, but that exception generally doesn't stretch to cover independent practices, even ones whose providers hold privileges there.

What Maryland Practices Are Actually Dealing With

Talk to enough office managers this year and the same complaints keep coming up. They're not vague. They're specific, and they cost real money.

A new hire who can't bill yet. Fully credentialed with the malpractice carrier, fully privileged at the hospital, seeing patients, and still can't get reimbursed because payer enrollment hasn't cleared. Every week that drags on is money the practice never gets back.
A CAQH attestation nobody remembered to renew. Maryland Medicaid and most commercial payers lean heavily on a current CAQH ProView profile, which needs re-attesting roughly every 120 days. It's an easy deadline to lose track of, and a lapsed attestation quietly stalls an application that otherwise looked complete.
Directory listings that don't match reality anymore. Now that carriers are required to build directories primarily off the uniform credentialing system, a wrong address or an outdated panel status isn't just embarrassing; it actively sends patients and referring physicians somewhere else.
Genuine confusion about which portal to use mid-transition. Practices submitting Medicaid paperwork in the weeks around the hold dates and the MPRIME launch aren't always sure whether their submission carries over cleanly. Not surprisingly, state help-line volume tends to spike right around migrations like this one.
DEA and Maryland CDS registrations that don't line up. Maryland requires both a federal DEA registration and a state Controlled Dangerous Substances registration for anyone prescribing. A mismatch between the two, often only discovered mid-credentialing, can stall an application that was otherwise ready to go.
Assuming CAQH covers CareFirst too. It doesn't. CareFirst requires its own supplemental questionnaire on top of the CAQH attestation, and it varies by provider type. Missing it is one of the more common reasons a Maryland credentialing file gets kicked back for "more information."

A Checklist You Can Use Before October

Check your SDAT status today. Confirm the organization's SDAT ID is active and in good standing, and that individual billing providers have IDs starting with "L." Do it now, not after MPRIME is live and you find out the hard way.
Get CAQH ProView current and attested. Since Medicaid and most commercial payers pull from it directly, a stale or unattested profile is probably the single most common self-inflicted delay out there. Put a recurring reminder on the calendar well before the roughly 120-day window closes.
Make a real list of every pending application. Medicaid, HealthChoice MCOs, and commercial carriers: all of it. Note the submission date and which portal it went through. Anything submitted close to the ePREP hold dates deserves an extra follow-up call, not just an assumption it's fine.
Cross-check DEA and Maryland CDS registrations. Expiration dates and registered addresses: line them up for every prescribing provider on staff.
Don't assume MCO enrollment covers Fee-for-Service. Verify both layers of HealthChoice enrollment separately for every Medicaid-participating provider.
Handle CareFirst separately from CAQH. Given how much of the commercial market it holds in this state, confirm the CareFirst-specific questionnaire is actually done, for every provider, not just the CAQH attestation.
Audit your directory listings across every payer you're contracted with. Address, phone, specialty, and panel status: all of it, since directories now pull primarily from the uniform credentialing system.
Put revalidation on the same calendar, not a separate one. Medicare requires revalidation on a five-year cycle for most provider types (three years for DMEPOS suppliers), with due dates typically posted around seven months out. Medicaid generally follows a similar five-year federal floor, and CMS has been signaling interest in more frequent state-level revalidation going forward. Miss one notice and you're looking at a payment hold or deactivation, so this belongs right next to your HB 1093 and MPRIME to-dos, not tucked away somewhere nobody checks.
Give someone actual ownership of this. Credentialing tasks spread across three inboxes are the ones that fall through. One person, or one outside team, should own the tracking, start to finish.

Where Practices Usually Trip Up

Treating credentialing like a one-time task instead of ongoing upkeep. Recredentialing, revalidation, and directory updates: none of it ever really stops.
Letting a CAQH attestation quietly lapse mid-application. This alone accounts for a huge share of "incomplete" application rejections across the industry.
Submitting applications that are missing something. It's consistently cited as the leading cause of enrollment delays in Maryland specifically, and it's almost entirely avoidable with a checklist.
Assuming hospital credentialing covers payer enrollment too. Privileges and network participation are not the same thing, even though they get treated that way all the time.
Forgetting the SDAT good-standing requirement entirely, since it lives outside the healthcare world in a separate state business registry most credentialing staff never think about.
Waiting until the last minute to submit or update Medicaid paperwork right before the portal switch, the exact window where things are most likely to get messy.
Remembering the federal DEA number but forgetting Maryland requires its own CDS registration on top of it.

If You Only Do Three Things

Get CAQH ProView and SDAT status current this month. Both are the foundation everything else depends on, and both are fixable in days, not months.
Put a name and a checklist on every open file. Vague ownership is exactly where delays quietly pile up.
Build in extra time around the transition window. If new providers are starting in September or October, begin their paperwork earlier than usual, and confirm in writing which portal, ePREP or MPRIME, their application is actually routing through.

Practices that treat this as routine housekeeping instead of a fire drill tend to come out the other side with faster credentialing than they had before, honestly, because HB 1093's shorter timelines work in your favor too. Carriers are now on the clock, not just you.

Should You Just Outsource This?

Not everyone needs to. A solo practitioner with two or three payer contracts and a genuinely on-top-of-it office manager can track SDAT status, CAQH attestation, and a couple of Medicaid applications without bringing in outside help. No shame in doing it yourself if it's working.

Where outsourcing tends to actually pay for itself:

The practice is growing, and new providers need to start billing fast, not eight weeks from now.
You're juggling enrollment across more than just Maryland.
A provider has already sat idle, unable to bill, because something stalled.
Nobody on staff has real bandwidth to treat recredentialing and revalidation as an ongoing job instead of something everyone scrambles to remember once a year.
You want someone else double-checking the Maryland-specific stuff, SDAT status, the CareFirst questionnaire, and DEA/CDS alignment, since incomplete submissions are the state's single biggest cause of delay.

This is the exact work Edge RCM's credentialing and payer enrollment team handles day in and day out for Maryland practices: CAQH and NPI setup, Medicare and Medicaid enrollment, commercial payer contracting, and ongoing revalidation tracking, so a new hire starts billing on day one, not week eight.

And if credentialing delays have already cost your practice money, it's worth a look at how Edge RCM's revenue cycle management services tie enrollment status directly into claims and denial management, so a credentialing gap doesn't quietly turn into a pile of unworked denials.

Questions People Keep Asking

When does HB 1093 actually take effect?

October 1, 2026. It amends Maryland Insurance Article § 15-112.1 and strengthens the state's uniform credentialing form requirements.

Does HB 1093 touch Medicaid, or just commercial insurance?

Just commercial carriers and their credentialing intermediaries, under the Insurance Article. Medicaid enrollment runs on its own track, through the state's provider enrollment portal, the one moving from ePREP to MPRIME around the same time, but under different authority.

Can a carrier still charge me a fee to submit a credentialing application?

No. HB 1093 removes the prior authorization for carriers to charge that fee.

What if I submit a Medicaid application right before the ePREP hold date?

Maryland Medicaid has said the transition isn't expected to disrupt existing claims, payments, or data. Still, if you're submitting anything close to a hold date, follow up directly to confirm it went through cleanly. Migrations like this carry more risk than routine processing, even when everyone involved is doing their job well.

What's the SDAT ID and why does MPRIME care about it?

It's a State Department of Assessments and Taxation identification number confirming your organization's legal structure. Maryland Medicaid requires an active, good-standing SDAT ID to submit applications under MPRIME, and individual billing providers need one starting with "L."

How often does CAQH ProView actually need attesting?

Roughly every 120 days for most payers, Maryland Medicaid included. A lapsed attestation is one of the most common reasons a seemingly complete application just... stalls.

Does a CAQH attestation cover CareFirst's requirements too?

Not on its own. CareFirst, which holds a dominant chunk of Maryland's commercial market, needs its own provider-type-specific questionnaire in addition to the CAQH profile.

How long does credentialing usually take in Maryland?

It varies by payer and provider type, but 60 to 90 days is common when the application is complete the first time around. Incomplete applications are consistently the reason it drags on longer than that.

How often do I need to revalidate my Medicare enrollment?

Most providers and suppliers revalidate every five years; DMEPOS suppliers revalidate every three, per CMS regulations at 42 CFR § 424.515. Due dates get posted roughly seven months in advance, and there are no extensions of any kind.

What's the single biggest mistake Maryland practices make here?

Submitting an incomplete application. It's the leading cause of enrollment delays in the state, and it's almost entirely preventable with a written checklist and someone actually responsible for it.

Where That Leaves You

October 1, 2026 isn't a date to skim past in an email and forget about. Between HB 1093 changing how commercial carriers have to credential Maryland providers, and Medicaid's full move from ePREP to MPRIME, this is genuinely one of the bigger shifts in Maryland's provider enrollment landscape in a while.

And to be clear, most of it works in your favor. Shorter carrier decision windows. No more application fees. One uniform system instead of a different form for every payer you touch. None of that helps, though, if your CAQH profile lapsed six months ago, your SDAT status is out of date, or you've got applications sitting half-finished in a portal that's about to be retired.

Start with the basics this month: CAQH attestation, SDAT status, and an honest list of every open application, and you'll be ahead of a good chunk of the state by the time October rolls around.

If your team just doesn't have the room to take this on alongside everything else, Edge RCM handles Maryland credentialing, payer enrollment, and revenue cycle management under one roof, with one team that actually owns the outcome. Book a free practice assessment and we'll give you a straight read on where your enrollment and credentialing actually stand before the deadline, and what it would take to close any gaps.