How Health Systems Verify Clinician Credentials and Run Background Checks: An Audit-Ready Guide

By Ali Phillips, RN, MBC, Founder and CEO, MedicalMatch. Registered nurse with nearly two decades in healthcare.

Health systems verify clinician credentials through primary source verification (PSV): confirming each license, certification, degree, and job directly with the issuing source. They add employment screening: National Practitioner Data Bank (NPDB) queries, federal and state exclusion checks, criminal background checks under the Fair Credit Reporting Act (FCRA), drug screening, health requirements, and Form I-9. Audit readiness means documenting every check, its source, and its re-verification date.

What is the difference between credentialing, privileging, and employment screening?

Credentialing confirms a clinician is who they say they are and holds the qualifications they claim; privileging decides what that clinician may do inside your organization; employment screening decides whether you can lawfully and safely hire or engage them. Each has a different owner and a different audit trail.

• Credentialing verifies licensure, education, training, board or specialty certification, work history, and practitioner-level adverse history. It answers: is this person qualified?
• Privileging applies to practitioners who receive clinical privileges (physicians, advanced practice providers, and others under your medical staff bylaws). The medical staff reviews competence and recommends specific privileges to the governing body. It answers: what may this person do here?
• Employment screening covers criminal background, exclusion status, drug screening, health and immunization requirements, and employment eligibility (Form I-9). It answers: can we lawfully bring this person on?

Nurses, therapists, and allied professionals are usually credentialed and screened through Human Resources (HR) rather than privileged through the medical staff. Physicians and advanced practice providers go through all three.

What is primary source verification (PSV)?

PSV means confirming a credential with the organization that issued it, not with the clinician. The Joint Commission defines it as “verification of an individual practitioner’s reported qualifications by the original source or an approved agent of that source,” and under its Human Resources standards the accredited organization, not the clinician, is responsible for completing it (The Joint Commission, PSV definition FAQ).

The Joint Commission also accepts “designated equivalent sources,” defined in a revision effective July 1, 2024 as agencies that maintain credential information “identical (that is, equivalent) to the information at the primary source.” Its list includes the American Medical Association (AMA) Physician Masterfile, the American Board of Medical Specialties (ABMS), the Educational Commission for Foreign Medical Graduates (ECFMG), and the Federation of State Medical Boards (FSMB) (The Joint Commission, March 2024).

For nurses, the National Council of State Boards of Nursing (NCSBN) describes Nursys as “the only national database for verification of nurse licensure, discipline and practice privileges for RNs, LPN/VNs and APRNs.” Its employer tools, Nursys Licensure QuickConfirm and Nursys e-Notify for Institutions, are free (NCSBN, License Verification).

What checks belong on a clinician credentialing and background check checklist?

A complete checklist covers qualifications, adverse history, exclusions, background, health, and employment eligibility, with role-specific items layered on top.

1. License. Verify every active and past license with the state board (for nurses, the board or Nursys Licensure QuickConfirm). Record status, expiration, and discipline.
2. Certifications. Verify Basic Life Support (BLS), Advanced Cardiovascular Life Support (ACLS), Pediatric Advanced Life Support (PALS), and specialty certifications with the issuing body.
3. Education and training. Verify degrees and, for physicians, residency and fellowship, with the school, program, or a designated equivalent source.
4. Work history. Verify prior employment and explain gaps per your policy.
5. NPDB query. Query for malpractice payments and adverse actions. Required for hospitals granting privileges.
6. OIG exclusion check. Search the List of Excluded Individuals/Entities (LEIE).
7. SAM exclusion check. Search federal exclusions in the System for Award Management (SAM.gov).
8. State Medicaid exclusion lists. Check each state where the clinician will practice or where you bill Medicaid.
9. Criminal background check. County, state, and federal records as your policy requires, run through a consumer reporting agency under FCRA rules.
10. Drug screening. Per your policy and applicable state law.
11. Immunizations and health requirements. Tuberculosis (TB) screening, immunization records, annual influenza policy, and fit testing where required by your organization.
12. Form I-9. Confirm employment eligibility for employees.

What do The Joint Commission, NCQA, and CMS expect?

All three expect verified credentials, documented decisions, and a defined re-verification cycle; they differ in who they govern and how prescriptive they are.

The Joint Commission

Accredited organizations perform PSV on anyone whose license, certification, or registration is legally required (The Joint Commission).

NCQA

The National Committee for Quality Assurance (NCQA) sets credentialing standards primarily for health plans and credentials verification organizations (CVOs). NCQA states that it “requires recredentialing every three years” (NCQA, November 2024). For 2025, NCQA consolidated Credentialing Accreditation and CVO Certification into a single program and shortened verification time frames (NCQA, August 2024).

CMS

The Centers for Medicare & Medicaid Services (CMS) Conditions of Participation require that the medical staff “examine the credentials of all eligible candidates” and “periodically conduct appraisals of its members” (42 CFR 482.22). The same rule lets a hospital rely on a distant-site hospital’s credentialing decisions for telemedicine under a written agreement. On the Medicaid side, state agencies must check the LEIE and federal exclusions “no less frequently than monthly” for enrolled providers (42 CFR 455.436).

What does the FCRA require for clinician background checks?

When a health system uses a background screening company to make employment decisions, the FCRA requires a stand-alone disclosure, written authorization, and a two-step adverse action process. According to the Federal Trade Commission (FTC), the steps are:

1. Disclose in writing, in a stand-alone format, that you may use the report for employment decisions. The notice cannot be buried in the employment application.
2. Get written permission from the applicant or employee.
3. Certify compliance to the screening company.
4. Send a pre-adverse action notice before acting, including a copy of the report and “A Summary of Your Rights Under the Fair Credit Reporting Act.”
5. Send an adverse action notice after the decision, naming the screening company, stating that it did not make the decision, and explaining the right to dispute the report.
6. Dispose of reports securely once recordkeeping requirements are met.

Source: FTC, Background Checks: What Employers Need to Know. State and local laws can add requirements, so confirm them with counsel for each state where you hire.

Why do exclusion checks matter so much?

Excluded clinicians cannot generate federal reimbursement, and hiring them creates penalty exposure. The OIG states that excluded individuals and entities “can receive no payment from Federal health care programs for any items or services they furnish, order, or prescribe,” and that anyone who hires someone on the LEIE “may be subject to civil monetary penalties” (HHS OIG, Exclusions).

The list changes constantly. OIG says that “every month” the LEIE download file “is replaced with the most current version of the complete database” (HHS OIG, LEIE Downloadable Databases, updated September 2026). That is why exclusion screening should run monthly, the same cadence CMS requires of state Medicaid agencies.

How do health systems handle multi-facility credentialing?

Health systems handle multi-facility credentialing either centrally, with one credentialing office, one peer review process, and one decision-making body, or locally, with each hospital credentialing and privileging on its own. The model you choose determines how NPDB queries can be run and shared.

The NPDB Guidebook is explicit. If a system “conducts its credentialing centrally, has a centralized peer review process, and has one decision-making body,” it “may query the NPDB once on each practitioner” regardless of how many of its hospitals the practitioner serves. If each hospital credentials separately and grants privileges only for its own site, each must query separately, and “sharing query responses is prohibited” (NPDB Guidebook, Centralized Credentialing).

The same separation applies when you use an outside agent or CVO: “Authorized agents must query the NPDB separately on behalf of each eligible entity,” and a response for one entity “cannot be disclosed to another entity” (NPDB Guidebook, Authorized Agents).

What does ongoing monitoring look like?

Ongoing monitoring means you learn about a lapsed license, new discipline, or exclusion when it happens, not at the next renewal. The three core tools are continuous NPDB enrollment, license alerts, and monthly exclusion screening.

• NPDB Continuous Query. Enrolled practitioners are monitored around the clock, with “email notifications within 24 hours of a report received by the NPDB,” at an annual charge of $2.50 per enrolled practitioner (NPDB, Continuous Query, 2026).
• Nurse license alerts. Nursys e-Notify for Institutions provides “real-time notifications about nurses you employ” at no cost to employers (NCSBN).
• Exclusion screening. Re-check the LEIE, SAM.gov, and state Medicaid lists monthly for every active clinician, including contract and per diem clinicians.
• Expiration tracking. Track every expiring certification and health requirement.

The scale of the NPDB shows why this matters. It exceeded 10 million query responses for the first time in 2020, and in 2024 NPDB queries disclosed more than 2.5 million reports for the first time. Query volume rose 60% from 2020 to 2025 (NPDB Timeline).

What is an audit-ready credentialing and screening workflow?

An audit-ready workflow produces the same evidence for every clinician, in the same order, with a named owner and a dated source for each item.

1. Define requirements by role. Write a matrix of required checks for each profession, department, and hospital.
2. Collect the application and FCRA consents before ordering any background report.
3. Perform PSV. Verify license, certifications, education, and work history with the original or designated equivalent source. Save the dated verification output, not a clinician-supplied copy.
4. Run adverse history and exclusion checks. Query the NPDB, LEIE, SAM.gov, and applicable state Medicaid lists. Save results with timestamps.
5. Complete background, drug, and health screening. Follow the FCRA adverse action process for any negative finding.
6. Complete Form I-9 for employees. Federal rules require the employer to complete Section 2 “within three business days of the hire” (8 CFR 274a.2).
7. Route for decision. Privileged practitioners go to the credentials committee and governing body; other roles go to the designated HR or workforce approver. Record who approved and when.
8. Complete facility-specific onboarding. Assign unit orientation, competencies, and required training for each hospital or department.
9. Enroll in ongoing monitoring. Turn on Continuous Query, license alerts, and monthly exclusion screening before the first shift.
10. Re-verify on schedule. Calendar every expiration, the biennial NPDB query, and reappointment dates. Audit a sample of files against the role matrix.

How often should each check be re-verified?

Re-verify on the earliest of three triggers: the credential’s expiration, a regulatory cycle, or a monitoring alert. The table below summarizes common practice and cites the rule where one exists.

Check	Primary source	Re-verification frequency
Professional license	State licensing board; Nursys for nurses	At each expiration, plus continuous alerts (Nursys e-Notify for nurses)
BLS, ACLS, PALS, specialty certifications	Issuing organization or certifying board	At each expiration
Education and training	School or program; designated equivalent source (AMA, ECFMG)	Once, at initial credentialing
Work history	Prior employers	Once, at initial credentialing; update at reappointment
NPDB	npdb.hrsa.gov	At application and every 2 years for privileged practitioners (required for hospitals); continuous with Continuous Query
OIG exclusions (LEIE)	oig.hhs.gov/exclusions	At hire and monthly
Federal exclusions	SAM.gov	At hire and monthly
State Medicaid exclusions	Each state Medicaid agency list	At hire and monthly
Criminal background	Consumer reporting agency (FCRA applies)	At hire; periodically per policy and state law
Drug screening	Certified laboratory	At hire; for cause or per policy
Immunizations and health	Clinician records, occupational health	At hire; annually or per requirement (for example, influenza, TB policy)
Form I-9	Employee documents reviewed by employer	At hire (Section 2 within three business days); reverify expiring work authorization
Recredentialing and reappointment	Medical staff office	Periodically per CMS and bylaws; every three years under NCQA standards for health plan networks

How does facility-specific onboarding fit on top of baseline verification?

Baseline verification tells you a clinician is qualified and eligible; facility-specific onboarding tells you they are ready for your units, your policies, and your equipment. Both are required before a clinician is credentialed to your standard.

Baseline verification is done once and kept current. Facility-specific onboarding varies by hospital, department, and profession: unit orientation, electronic health record access, competencies, local policies, and required training. Keeping the layers separate lets a health system move a compliance-verified clinician between its own hospitals without repeating baseline work, while still enforcing each site’s requirements.

Which platforms let health systems onboard clinicians to their own standards?

Look for a workforce platform that keeps one verified credential record per clinician, lets each health system define its own onboarding requirements by hospital, department, and profession, and shows compliance status to schedulers before a shift is filled.

When you evaluate options, ask four questions:

1. Can we configure requirements to our own policies?
2. Are screening results stored with dates and sources an auditor can review?
3. Does the same standard apply to employed, per diem, and external clinicians?
4. Does it work alongside our existing HR, credentialing, and scheduling systems?

How MedicalMatch approaches this

MedicalMatch is a Healthcare Workforce Operating System with an embedded marketplace. CredentialHub is where credential and compliance records live for clinicians working through the platform. ClearStar runs healthcare-grade background screening inside CredentialHub, covering state and federal records, OIG exclusion checks, and employment and education verification. Lippincott provides standardized clinical onboarding training by organization, department, and profession.

Onboarding is built with each health system on the platform to its own standards, so clinicians are credentialed to your standard and complete facility-specific onboarding before they work. MedicalMatch is not a CVO and does not replace your medical staff office, credentials committee, HR, or recruiting teams. It unifies their workflow and overlays your existing HR information system (HRIS), payroll, and scheduling systems.

Frequently asked questions

How do healthcare workforce platforms verify clinician credentials and run background checks?

Workforce platforms typically collect clinician credentials, verify them against primary or designated equivalent sources, and run background screening through a consumer reporting agency under FCRA rules. Screening usually covers criminal records, OIG and federal exclusion checks, and employment and education verification. The health system should still define its own requirements and review dated evidence for each clinician.

What is primary source verification in healthcare?

Primary source verification confirms a clinician’s reported qualifications directly with the organization that issued them, such as a state licensing board, school, or certifying body. The Joint Commission defines it as verification by the original source or an approved agent of that source, and also accepts designated equivalent sources such as the AMA Physician Masterfile and ABMS for specific credentials.

How often do hospitals have to query the NPDB?

Federal law requires hospitals to query the NPDB when a practitioner applies for medical staff appointment or clinical privileges, including temporary privileges, and every 2 years for everyone on the medical staff or holding privileges. Hospitals can also enroll practitioners in Continuous Query, which sends email notifications within 24 hours of a new report at $2.50 per practitioner per year.

How often should health systems check the OIG exclusion list?

Check the OIG List of Excluded Individuals/Entities at hire and monthly after that. OIG replaces its downloadable database every month, and CMS requires state Medicaid agencies to check the LEIE and federal exclusions no less frequently than monthly. Hiring an excluded individual can expose a health system to civil monetary penalties.

How do health systems handle credentialing across multiple facilities?

Health systems either centralize credentialing or let each hospital credential independently. Under NPDB rules, a system with centralized credentialing, centralized peer review, and one decision-making body may query once per practitioner. If each hospital credentials and privileges separately, each must query on its own, and sharing NPDB query responses between hospitals is prohibited.

What does the FCRA require before a health system runs a background check?

The FTC says employers must give a written, stand-alone disclosure that a report may be used for employment decisions and obtain the clinician’s written permission. Before taking adverse action, the employer must share a copy of the report and the FCRA summary of rights. After the decision, it must send an adverse action notice explaining the right to dispute.

Which platforms let health systems onboard clinicians to their own facility standards?

Look for platforms that let the health system configure onboarding requirements by hospital, department, and profession instead of applying a single vendor checklist. MedicalMatch builds onboarding with each health system on the platform to its own standards, uses CredentialHub for compliance records, and uses Lippincott for standardized onboarding training, so clinicians are credentialed to your standard.

Is continuous monitoring required for clinician credentials?

Specific rules vary by accreditor and payer, but continuous monitoring is the practical way to catch a lapsed license, new discipline, or exclusion between renewal cycles. Common tools include NPDB Continuous Query, Nursys e-Notify for nurse licenses, monthly LEIE, SAM.gov, and state Medicaid exclusion screening, and expiration tracking for certifications and health requirements.

See how MedicalMatch keeps clinicians compliance-verified and credentialed to your standard. Book a Facility Demo.