Credentialing and Background Checks: What Healthcare Employers Must Legally Verify

Credentialing and Background Checks: What Healthcare Employers Must Legally Verify

By Nicole Statley at Healthcare Compliance Pros

A new provider is ready for day one. Can they legally treat patients and bill insurance right away? In most cases, no.

Credentialing and background checks are two separate legal requirements, and both changed significantly in 2025 and 2026. Here's what practice administrators, credentialing staff, and compliance officers need to know.

Credentialing vs. Enrollment vs. Background Checks

These terms get confused constantly, and that confusion causes onboarding delays.

• Credentialing verifies a provider's qualifications: education, training, licensure, certifications, and work history. Done by a hospital's medical staff office, a health plan, or a Credentials Verification Organization (CVO).
• Enrollment contracts the provider with a specific payer (Medicare, Medicaid, commercial insurer) so claims can be reimbursed. Medicare enrollment runs through PECOS using the appropriate CMS-855 form.
• Background checks confirm the person doesn't have a criminal history, disciplinary record, or exclusion status that legally bars them from the role.

A provider can be fully credentialed and still unable to bill if enrollment isn't done. Run both processes in parallel, but track them separately.

Background Check Rules by Setting

Background check rules differ by state, facility type, and whether the role involves direct patient contact. There is no single federal standard covering every healthcare worker.

• Long-term care (federal): The National Background Check Program (NBCP), created under ACA Section 6201, funded FBI fingerprint-based checks for "direct access employees" across several categories of long-term care providers, including skilled nursing, home health, hospice, and assisted living. HHS-OIG's final assessment found the program helped 27 states build or improve background check systems. States using these systems disqualified at least 106,000 individuals with concerning convictions from long-term care employment.
• Nursing homes specifically: CMS regulations bar employing anyone with a history of resident abuse, neglect, exploitation, or mistreatment, established through a court finding, state nurse aide registry, or licensure disciplinary action.
• State licensure screening: Many states add fingerprint-based checks and registry screening as a condition of licensure, not only employment. Scope and frequency vary by state and role. Always confirm requirements in every state where you employ or credential staff.

What Credentialing Files Must Verify

Per NAMSS core criteria (specifics vary by bylaws, payer policy, and state law):

• Education and training (medical school, residency, fellowship)
• Current, unrestricted state licensure
• Board certification status, where applicable
• DEA/CDS registration, if prescribing controlled substances
• Malpractice history (typically 5 years)
• Work and practice history, including gaps
• Federal exclusion and sanction status

Exclusion screening deserves special attention. OIG's List of Excluded Individuals/Entities (LEIE) identifies people and entities barred from federally funded healthcare programs. Billing for an excluded individual's services can trigger civil monetary penalties. This is not optional due diligence. SAM.gov maintains a separate federal exclusion database, and many programs check both.

Hospitals have an extra requirement. Federal law requires hospitals, and only hospitals, to query the National Practitioner Data Bank (NPDB) at initial appointment and every two years after for active staff.

Primary Source Verification, Explained

Primary source verification (PSV) means confirming a credential directly with the issuing institution, not just the provider's paperwork or a generic database.

• A license check pulled from the state board's own lookup counts as PSV.
• A license status from a general people-search vendor does not satisfy accreditation-level PSV.
• Organizations pursuing NCQA Credentialing Accreditation treat PSV as an audited standard, not a best practice.

The 2026 Shift: Continuous Monitoring

Credentialing is moving from periodic snapshots to near-continuous monitoring, driven by two forces:

• Tighter accreditation timelines. NCQA now enforces shorter windows between credential verification and the credentialing decision. Files can't sit for months.
• Ongoing exclusion monitoring. OIG recommends routine LEIE checks, not just at hire, since exclusions can be added anytime. State Medicaid programs must check LEIE monthly for new and continuing enrollments. Many CVOs now monitor licenses, sanctions, and exclusions monthly across their entire roster.

This matters most for multi-state telehealth providers. A lapsed or sanctioned license in one state can affect privileging in every state where that license mattered.

The Cost of Getting It Wrong

• Industry benchmarking cited by MGMA-affiliated sources puts annual revenue risk from credentialing and enrollment bottlenecks above $1 million for many hospital organizations.
• Missing a credentialing committee's meeting cycle commonly adds 30 or more days to onboarding while the provider sits idle.
• Negligent credentialing claims are possible if an organization credentials someone unqualified or previously disciplined when that fact was discoverable. Liability exposure depends on state law, so consult legal counsel for specific cases.

Quick Checklist

Pre-hire:

• Verify license directly with the licensing board
• Confirm DEA/CDS registration, if applicable
• Verify board certification with the certifying body
• Pull and review malpractice history
• Screen against OIG LEIE and SAM.gov exclusion databases
• Run the state/role-required criminal background check (fingerprint-based where mandated)
• Query the NPDB (required for hospitals)

Onboarding:

• Complete and attest the CAQH ProView profile
• Route the file to the credentialing committee ahead of its next meeting
• Start payer enrollment applications in parallel with credentialing

Ongoing:

• Monitor licenses, sanctions, and exclusions on a recurring basis
• Track revalidation and recredentialing deadlines early
• Re-verify each multi-state license individually
• Refresh background and registry checks per your state's renewal schedule

How HCP's Credential Manager Helps

Manual tracking is where credentialing programs break down. It is not from lack of knowledge. It is because manual tracking does not scale as the provider roster grows.

• Centralizes license, certification, and renewal tracking in one place
• Integrates with background check and exclusion screening processes
• Helps catch a lapsed license or overdue re-screen before a claim is denied or a survey finding is issued

Credentialing, background checks, and payer enrollment are three separate legal requirements. Each one stands between hiring a provider and generating billable revenue from their work. Schedule a credentialing program review with Healthcare Compliance Pros to see where your process stands.

FAQ

Is credentialing the same as a background check?
No. Credentialing verifies professional qualifications (education, licensure, certifications). A background check verifies criminal history, discipline, and exclusion status. Most roles require both.

Is credentialing the same as payer enrollment?
No. Credentialing verifies qualifications. Enrollment contracts the provider with a payer so claims can be reimbursed. Both are required before billing.

Are fingerprint-based background checks required for all healthcare workers?
It depends on the state and role. Many states require them for licensure or direct patient contact roles. Long-term care has added federal requirements under the NBCP. No single nationwide standard applies, so check each state where you operate.

What does primary source verification mean, and why does it matter?
PSV means confirming a credential directly with the issuing body (state board, school, certifying board), not just paperwork or a generic database. Most accreditors and payers require it for a credentialing decision to hold up.

How often should organizations check licenses and exclusions?
Requirements vary, but the trend favors monthly monitoring of licenses, sanctions, and exclusions rather than waiting for a multi-year recredentialing cycle.

Do small practices face the same requirements as hospitals and nursing homes?
Not exactly. Hospitals must query the NPDB, and long-term care facilities face specific federal background check rules. These don't apply to most independent practices, though small practices still need solid license, exclusion, and background verification.

What happens if we bill for a provider on the OIG exclusion list?
You risk civil monetary penalties. Routine LEIE and SAM.gov screening, not just a one-time check, is how organizations avoid this exposure.