Visit Website →
← Back to blog

Primary Source Verification: 3 U.S. Authorities for Credentialing

October 14, 2026
Primary Source Verification: 3 U.S. Authorities for Credentialing

Primary source verification means contacting the issuing authority directly to confirm a practitioner's license, certification, or education, not accepting a copy from the practitioner. The Joint Commission and CMS both expect credentialing teams to perform and document this check at hire, at renewal, and whenever privileges change. The immediate action: verify state license and federal exclusion status straight from the issuing registries, then record who verified it, when, and through which source.

TL;DR:

  • Verify each credential directly with its issuing authority; supplied copies do not count, and record the source, date, method, result, and verifier’s name.
  • Check state licenses, DEA registration when prescribing privileges apply, board certification, relevant training, malpractice records, and all three exclusion lists: OIG, SAM, and GSA.
  • Check at credentialing, renewals, privilege changes, and between cycles; CMS revalidation occurs every five years for most providers and every three years for DME suppliers.
  • Save dated registry screenshots or exports, document phone or email confirmations, and escalate identity mismatches, gaps, or exclusion hits for human review before approval.
Connectedmedics
Connect With Verified Healthcare Professionals
ConnectedMedics brings healthcare professionals together through verified profiles, healthcare-specific job opportunities, and clinical insights from medical experts.
Explore ConnectedMedics

Table of Contents

What primary source verification is, and why it matters

Primary source verification, often shortened to PSV, means confirming a credential by going to the organization that issued it, not by reviewing a document the clinician hands over. A diploma photo, a scanned license, or a self-reported certification number does not meet the standard on its own.

Accrediting bodies and payers require PSV because credentialing failures carry real consequences: unqualified practitioners treating patients, billing fraud, and license actions that go unnoticed until something goes wrong. The Joint Commission's standards FAQ on primary source verification states that organizations must verify licensure, training, and current competence from the primary source whenever feasible, and surveyors expect to see documentation of who performed the verification and what it found.

A compliant PSV file generally shows:

  • Confirmation obtained directly from the issuing board, school, or registry
  • A documented date, method, and result for each verification
  • The name and role of the person who performed the check
  • Evidence that exclusion and sanction databases were checked, not just the license itself

Who requires PSV and where to find the rules

Three bodies shape PSV requirements for most U.S. organizations, and their expectations overlap but are not identical.

  • The Joint Commission evaluates PSV during accreditation surveys under standards MS.17.01.03 (EP 3) and MS.17.02.01 (EP 9), which require documented verification of licensure, training, and competence from the issuing source.
  • CMS enforces provider enrollment and revalidation rules under 42 CFR § 424.515, using PECOS and the CMS-855 enrollment forms to track and periodically revalidate provider records.
  • State licensing boards remain the final word on license status and discipline, and state-specific rules sometimes add requirements beyond what accreditors or CMS demand.

Credentialing staff working across state lines should treat state board portals as a required stop, not a backup source, since license standing can differ from what a national registry shows.

Which credentials and records to verify

A complete PSV file touches more than the license. Build the check around this order, from highest risk to lowest:

  1. State medical license: confirm current status directly with the issuing state board, not through a copy.
  2. DEA or controlled-substance registration: verify active status for any prescribing privileges.
  3. Board certification: confirm directly with the certifying body, not from a wallet card or website printout.
  4. Residency and postgraduate training: verify with the training program when privileges depend on it.
  5. Education: verify directly when the license does not already confirm degree completion, particularly for foreign-trained clinicians whose licensing board may not require independent degree verification.
  6. Malpractice history and NPDB reports: pull directly from the National Practitioner Data Bank.
  7. OIG, SAM, and GSA exclusion status: check all three, since exclusions can appear on one list and not another.
  8. Work history: confirm gaps and prior affiliations as part of the overall risk picture.

Timing matters as much as the list itself: verify at initial credentialing, again at any privileging change, at renewal, and through ongoing monitoring between cycles rather than waiting for the next full cycle to catch a new exclusion or sanction.

What counts as a primary source and acceptable evidence

Not every document that looks official qualifies as a primary source. The accepted primary sources for most U.S. credentials are state licensing boards, board certifying bodies, accredited medical schools, the NPDB, the DEA, the OIG List of Excluded Individuals and Entities, and PECOS or NPPES for federal enrollment status.

Acceptable evidence generally includes:

  • An authenticated export or screenshot from the issuing registry, dated and attributable
  • A documented phone or email exchange with the issuing authority, including who was contacted and what they confirmed
  • A secure electronic verification through a recognized portal or API

Designated equivalent sources and credentials verification organization (CVO) reports can satisfy PSV when the organization using them has reviewed how that source or CVO gathers and verifies its data. A report that simply repeats what the clinician submitted does not meet the standard on its own.

Methods, channels, and documentation for performing PSV

Three methods cover most verification work: a documented phone call to the issuing office, a secure email exchange with the issuer, or an authenticated export from a registry portal. Each needs to leave a paper trail that a surveyor can follow without asking follow-up questions.

  1. Call or email the issuing authority directly and log the date, the person who answered, and exactly what they confirmed.
  2. Pull registry data from PECOS and NPPES, the NPDB, state board portals, and the DEA Diversion Control Division for controlled-substance registrations.
  3. Capture a snapshot of the registry result at the time of verification, since license status can change and a later lookup will not reproduce what you saw.

Every record should capture, at minimum: verifier name and role, date of verification, issuing source, method used, the specific credential details confirmed, the expiration date, and a saved copy of the evidence.

Pro Tip: Save a dated screenshot or PDF export alongside the written log entry. A note that says "verified by phone" without a saved artifact is the first thing a surveyor will flag.

Dated verification evidence paired with a log entry

Common challenges and errors in PSV and how they cause risk

Most PSV findings during surveys trace back to a short list of repeat mistakes.

  • Accepting a license copy, diploma photo, or clinician-supplied PDF as the verification itself, rather than confirming with the issuer.
  • Relying on a single registry result instead of cross-checking a second source when something looks off.
  • Letting a slow state board response stall the file without logging the attempt, the date, and the follow-up.
  • Treating a name, NPI, or TIN mismatch as a clerical error instead of pivoting to a second data point (date of birth, prior address, alternate license number) to resolve it.
  • Checking exclusion lists once at enrollment and never again, which misses sanctions imposed after hire.

Ongoing exclusion monitoring matters because a clinician who passes PSV at hire can be excluded months later, and CMS guidance expects periodic re-checks against OIG and related lists, not a one-time lookup.

Best practices and an operational PSV workflow

A repeatable workflow keeps PSV consistent across hires and renewals instead of depending on individual staff judgment.

  1. Intake: log the practitioner type and determine which credentials require PSV based on role and privileges requested.
  2. Identify required elements: map the credential list against the 13 NAMSS verification elements commonly used as a credentialing baseline.
  3. Source pivoting: use one verified data point, such as a confirmed license number, to locate and cross-check related credentials like board certification or training history.
  4. Collect and document: record verifier, date, source, method, and a saved evidence snapshot for each element.
  5. Escalate red flags: route mismatches, gaps, or exclusion hits to compliance or legal before the file moves forward.
  6. Schedule monitoring: set recurring checks for license renewal dates, DEA registration, and exclusion lists between full credentialing cycles.

Combine in-house checks with a CVO or automated registry queries where volume makes sense, but keep a human review step for anything flagged as a mismatch or an edge case involving foreign credentials.

Pro Tip: Build your audit-ready file as a single chronological record per practitioner, not scattered emails and attachments, so a surveyor can review one document instead of reconstructing a timeline.

Tools, automation, and outsourcing options

A handful of federal and state registries cover most PSV work: PECOS and NPPES for Medicare enrollment status, the NPDB for malpractice and adverse action history, the OIG LEIE and SAM/GSA exclusion lists, the DEA Diversion registry for controlled-substance registrations, and individual state board portals for license status.

  • Automated registry queries speed up high-volume, standard cases but still require manual review for foreign-trained clinicians, name mismatches, or documents that look altered.
  • A credible CVO report should name its sources for each data point, include the verification date, and show enough detail that a reviewer could reproduce the check rather than just trusting a pass or fail flag.
  • When selecting a CVO or automation vendor, ask how they handle discrepancies, how long they retain evidence, and whether their process aligns with Joint Commission and CMS documentation expectations.

Manual verification stays necessary whenever a registry result is ambiguous or a credential originates outside standard U.S. systems.

Timeline and revalidation: CMS cycles and monitoring cadence

CMS requires enrollment revalidation on a fixed schedule under 42 CFR § 424.515: most providers and suppliers revalidate every 5 years, while DME suppliers revalidate every 3 years.

  • Between revalidation cycles, check license status, DEA registration, and exclusion lists on a recurring basis rather than waiting for the next CMS deadline.
  • Set internal reminders ahead of license and DEA expiration dates so renewal verification happens before, not after, the credential lapses.
  • Document any mid-cycle discovery, such as a new exclusion or disciplinary action, with the date found, the source, and the corrective step taken, even outside the formal revalidation window.

ConnectedMedics' verification approach to supplementing PSV

Our platform verifies member profiles against the credential elements credentialing teams already track, including the kind of checks outlined in the 13 NAMSS verification elements and the steps described in how we verify doctor licenses and credentials.

  • Verified profiles give recruiters a starting point that reduces intake friction before formal PSV begins.
  • Our knowledge hub adds clinical context and research summaries that can support credentialing conversations without replacing a verification call.
  • Platform verification never substitutes for contacting the issuing authority. It narrows the field faster so your team spends PSV time on confirmed candidates instead of unqualified ones.

What survey readiness actually looks like this quarter

Survey readiness rarely fails on the hard cases. It fails on the routine file where someone accepted a license copy instead of calling the board, or skipped a second exclusion check because the first one came back clean. Most teams already know their weak spot.

Pull five random credential files this month and check whether every verification has a documented source, date, and verifier name. That single exercise tends to surface the gap before a surveyor does.

— David

How ConnectedMedics helps employers hire verified clinicians

Hiring moves faster when candidates arrive with verified credentials already attached to their profile. Our employer plans, including Free and Growth tiers, give recruiters access to a healthcare-specific jobs board and a credential-checked member base, so your team spends less time screening and more time on formal PSV for the candidates who matter. Growth starts at $99 per month, and Enterprise options are available for larger hiring volumes.

Connectedmedics

Check current plan details and start posting roles on the ConnectedMedics employers page.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

What is considered primary source verification?

Primary source verification is confirming a credential, such as a license or board certification, directly with the organization that issued it rather than accepting a copy from the practitioner. The Joint Commission requires this direct contact for licensure, training, and competence whenever feasible.

What does primary source verification mean in practice?

In practice, it means a documented phone call, secure email, or registry export from the issuing board, school, or federal database, with the verifier's name, date, and result recorded. A license copy or self-reported certification number does not satisfy the requirement on its own.

How long does source verification take?

Timing varies by credential and by how quickly the issuing board or registry responds, and some state boards respond slower than federal databases like the NPDB or PECOS. Teams should document every contact attempt and date while waiting, rather than leaving the file open with no record of progress.

What are five primary sources used in credentialing?

Common primary sources include state licensing boards, board certifying bodies, accredited medical schools, the National Practitioner Data Bank, and the DEA for controlled-substance registrations. PECOS and NPPES also serve as primary sources for federal enrollment status.

How often should exclusion lists be checked after hire?

Exclusion status should be checked at hire and then monitored on a recurring basis between formal CMS revalidation cycles, since a clinician can be excluded after enrollment. CMS guidance directs organizations to query OIG and related exclusion lists periodically, not just once at enrollment.

Sources