Primary Source Verification: A Credentialing Guide
Credentialing only means something if each credential was confirmed with the body that issued it. This guide covers what primary source verification is, which items get checked and where, the federal NPDB rule for hospitals, and how to keep proof that each check was done.
Primary source verification, in one sentence
Confirming a provider's credential directly with the organization that issued it (the licensing board, the school, the certifying board) instead of trusting a copy the provider hands you.
What Gets Verified, and Where
Accreditors and health plans publish their own lists, but the core items are the same almost everywhere. Each one has a source that can confirm it:
| Credential | Primary source |
|---|---|
| State license | The state licensing board, usually through its online license lookup |
| DEA registration | The Drug Enforcement Administration, for anyone prescribing controlled substances |
| Education and residency | The medical school and the training program, or an approved designated source |
| Board certification | The certifying board or its official verification service |
| Malpractice and adverse actions | The National Practitioner Data Bank (NPDB) |
| Exclusions and sanctions | OIG's List of Excluded Individuals/Entities (LEIE) and state Medicaid exclusion lists |
Items such as work history and peer references are collected and reviewed, but they are not “primary source” in the same sense: there is no single issuing body to confirm them. Gaps in work history should still be explained in writing.
For hospitals, the NPDB check is a federal requirement. A hospital must request information from the NPDB when a practitioner applies for medical staff membership or clinical privileges, and every 2 years after for everyone on staff (45 CFR 60.17). The same rule makes it the backbone of privileging decisions.
How to Do Primary Source Verification
1. Start from a complete application
Most practices pull the application data from the provider's CAQH profile, which more than 1,000 health plans and other organizations use (CAQH now operates as DataSpring). The CAQH credentialing guide explains the attestation cycle.
2. Check each item at its source and save the proof
Save a dated screenshot or PDF of every verification, with the name of the person who ran it. The saved proof is what an auditor or a health plan asks for, not the conclusion.
3. Screen for exclusions, then keep screening
OIG replaces the LEIE database every month, and its guidance to state Medicaid agencies says the list must be checked monthly and at every new enrollment. Most practices adopt the same monthly cycle for every employee and contractor, because billing for services from an excluded person can trigger civil money penalties.
4. Track expirations
- Licenses, DEA registrations, and board certifications all expire on their own schedules.
- Set reminders well ahead of each date; a lapsed license means a provider cannot see patients.
- A credentialing checklist or credentialing software keeps the dates in one place.
Using a credentials verification organization (CVO)
Primary Source Verification FAQ
Is a copy of the license good enough?
No. A copy proves only that a document existed at some point. The licensing board's own lookup shows whether the license is active today and whether any discipline is attached.
How often does verification have to be repeated?
At initial credentialing and again at every re-credentialing cycle, which health plans commonly run every few years, plus whenever a credential expires. Exclusion screening runs monthly.
Does this apply to nurse practitioners and PAs?
Yes, with the extra step of confirming any collaboration or supervision agreement their state requires. See the NP and PA credentialing guide.
Where does this fit in onboarding?
Before the first patient. Add it to the healthcare onboarding checklist so a new clinician is never scheduled ahead of a clean verification.