Primary source verification (PSV) means confirming a credential directly with the entity that issued it, or an approved agent acting for that entity. License, highest education or training, and board certification are the core items that always call for it. Start with the frameworks from NCQA, the Joint Commission, and CMS, then use the sections below to run each check and keep files audit-ready.
TL;DR:
- Verify licenses, highest education or training, and board certification directly with issuers; the license must remain active on the credentialing decision date.
- NAMSS recommends verifying 13 essential elements within 180 days before the credentialing decision; recredentialing commonly follows a cycle of three years.
- Record the date, verifier, source, method, and result for every check; note that photo identification was reviewed rather than retaining a copy.
- Delegating more than 50% of primary source verification requires an accredited or certified NCQA delegate; data collection software alone does not count as delegation.
- For telehealth clinicians, verify licensure in the state where each patient is located, and add every new practice state to the monitoring tracker.
Table of Contents
- What primary source verification covers
- Which primary source to query for each credential
- Acceptable methods and when a CVO can do the work
- Timeliness, look-back windows, and audit-ready files
- Ongoing monitoring for multi-state and remote clinicians
- Standards-aligned checklist and delegation safeguards
- Why this stays an operational priority
- How we complement PSV for employer hiring teams
- FAQ
- Sources
What primary source verification covers
PSV applies whenever you confirm that someone holds a valid license, certification, or registration. CMS guidance on PSV describes it as confirming degrees, licenses, and work history with the issuing organization or its authorized agent. Plan your file around two tiers.
- Core items: state license, highest level of education or training, and board certification, which Medicare Advantage guidance names as requiring PSV.
- Commonly verified elements: DEA registration, malpractice insurance history, clinical privileges, National Practitioner Data Bank (NPDB) data, and sanctions or exclusions.
- Documentation point: the license must be shown to be in effect on the date of the credentialing decision.
- Organizational discretion: accrediting bodies expect PSV on the core items, while many organizations decide for themselves how far to extend it to secondary elements.
The NAMSS Ideal Credentialing Standards list 13 essential data elements and recommend verifying them within 180 days before the credentialing decision. Recredentialing commonly runs on a three-year cycle. Our post on the 13 NAMSS elements walks through the full list.
Which primary source to query for each credential
Choose a reliable source appropriate to each credential, and document the verification method and results.
- License: the issuing state licensing board is the primary source. Check with the issuing state licensing board. For nurses in compact states, the Nurse Licensure Compact resources are relevant.
- Board certification: the American Board of Medical Specialties (ABMS) and the individual certifying boards. Per an NCQA FAQ, an expired board certification can still verify education or training, because the board performed primary source verification when it awarded the certification.
- Education and training: the residency program, the school registrar, or the Educational Commission for Foreign Medical Graduates (ECFMG) for international graduates. An agent such as the National Student Clearinghouse works if you document a contractual relationship entitling it to verify for the source.
- Adverse actions and malpractice: the National Practitioner Data Bank.
- Exclusions and debarments: the OIG exclusions list and the System for Award Management (SAM).
- Controlled substances: the DEA registration and the state controlled-substance registry.
For a shorter list of authorities, see our post on three U.S. verification authorities.
Acceptable methods and when a CVO can do the work
The Joint Commission definition of PSV accepts direct correspondence, documented telephone verification, secure electronic verification, and reports from an approved credentials verification organization (CVO). CMS adds documented fax and email to that list. A copy of a license handed over by the applicant, with no evidence your organization verified it, does not meet the intent.
Delegation is permitted but bounded. NCQA credentialing FAQs state that when more than 50% of PSV is delegated, the delegate must be NCQA Accredited or Certified, a rule that applies from July 2024. NCQA also clarifies that software that merely collects data is not delegation, while an entity that reviews and verifies information is.
Every verification record should capture:
- The date verified.
- The name of the person who verified.
- The primary source consulted.
- The method used.
- The result.
For identity checks, the Joint Commission accepts a government-issued or organizational photo ID with a notation in the file, and advises against keeping copies of photo IDs because of identity-theft risk.
Pro Tip: Record the verification at the moment you perform it. A date reconstructed weeks later is the first thing an auditor questions.
Timeliness, look-back windows, and audit-ready files
Timing rules decide whether a correct verification still counts. NAMSS recommends that essential elements be verified within 180 days before the credentialing decision, and recredentialing typically follows a three-year cycle. Check your own accreditor's standard for exact look-back periods on each element, since they differ.
NAMSS lists 13 essential data elements to verify from primary sources within 180 days before the credentialing decision. That makes the file's age as important as its contents.
A defensible file holds these fields for every credential:
- Verification date, so the look-back window can be proven.
- Verifier name or system identity.
- Primary source consulted, named specifically.
- Method used, such as secure portal, documented call, or CVO report.
- Result, including any discrepancy and how it was resolved.
The Joint Commission expects credentialing programs to define verification methods, sources, frequency, documentation, and responsible parties. If you delegate, document the arrangement and check the applicable NCQA requirements for delegated verification.
Ongoing monitoring for multi-state and remote clinicians
A clean initial verification goes stale the day a sanction posts. Continuous monitoring closes that gap.
- NPDB: enroll practitioners in continuous query so new reports reach you without a manual re-query.
- Board and sanction feeds: watch state board actions, OIG exclusions, and SAM entries on a recurring schedule.
- Multi-state licensure: keep one tracker listing every state license, its expiration date, and its status. Where the Interstate Medical Licensure Compact applies, record the state of principal license and each additional state issued through the compact.
- Renewal alerts: set reminders well ahead of expiration so a lapsed license never reaches the schedule.
- Telehealth and mobile staff: verify licensure in the state where the patient sits, not only where the clinician lives, and revisit the file whenever a new practice state is added.
Standards-aligned checklist and delegation safeguards
Use this sequence for each initial application and recredentialing cycle:
- Confirm applicant identity with a government-issued photo ID, and note it without keeping a copy.
- Verify the state license with the issuing board.
- Verify board certification with the ABMS or the certifying board.
- Verify education and training with the school, residency program, or ECFMG.
- Run NPDB, OIG, and SAM checks.
- Check DEA and controlled-substance status.
- Record date, verifier, source, method, and result for each item.
- Enroll the practitioner in continuous monitoring where your standards require it.
If you delegate verification, document the arrangement and the agent's authority, and check the applicable NCQA requirements.
Pro Tip: When results conflict, trust NPDB and state board sanctions first, then resolve the discrepancy before the file moves forward.
Why this stays an operational priority
My view after working through these standards is simple: PSV is an important part of staffing diligence, not a box to tick before a survey; connecting with the Veteran's Nexus Institute can provide physician-authored nexus letters and independent medical opinions helpful for veteran-related credential evaluations. Confirming a clinician's license and board status can help identify discrepancies. I would pair each initial check with an audit trail that another reviewer can follow. The checklist above can help teams prepare for an accreditor's review.
— David
How we complement PSV for employer hiring teams
Our verified profiles are not a substitute for your own primary source checks. What we do is connect your team with verified clinician profiles. Our verified clinician profiles and healthcare-only jobs board help you find healthcare professionals. Read more about our verified clinician profiles, then compare our employer plans or look at Premium Employer to support recruitment.
FAQ
What is primary source verification in healthcare credentialing?
It is confirming a credential directly with the organization that issued it, or an approved agent. The Joint Commission requires you to document the date, verifier, what was verified, and the result.
Which credentials always require primary source verification?
License, highest level of education or training, and board certification are the core items. Medicare Advantage credentialing guidance also expects the license to be shown as in effect on the decision date.
Can a CVO perform primary source verification for us?
Yes, if you document the contractual relationship and stay within NCQA limits. Delegating more than 50% of PSV requires the delegate to be NCQA Accredited or Certified, per the NCQA credentialing FAQs.
Is a copy of a license enough?
No. A copy supplied by the applicant, without evidence that your organization verified it with the source, does not meet the intent of PSV under the Joint Commission FAQ.
Should we keep a copy of the practitioner's photo ID?
The Joint Commission advises against it because of identity-theft risk. A notation in the credential file that the ID was reviewed is acceptable.
Sources
- S&C-16-18-CLIA Personnel Policies for Individuals Directing or Performing Non-waived Tests FAQS
- FOR INITIAL PRACTITIONER APPLICANTS