Medical Credential Verification: GMC, NMC Registers and Healthcare Accreditations

In 2024, the GMC (General Medical Council) investigated 47 cases of illegal medical practice in the UK, and NHS trusts suspended 312 practitioners for accreditation failures or insufficient qualifications. For a healthcare organisation, a practitioner in post with an unverified qualification or expired accreditation represents a legal risk (up to 2 years' imprisonment for facilitating unlawful practice), a patient safety risk and a financial risk (loss of CQC registration, commissioner contract termination). Manual verification — contacting the GMC, awaiting the NMC response, chasing the university — takes between 5 and 20 days per practitioner. Automated verification platforms reduce this to a few hours.

This article is for informational purposes only and does not constitute legal, financial or regulatory advice.

The challenge: why manual medical credential verification is no longer viable

Patient safety as the primary imperative

The Medical Act 1983 conditions the practice of medicine on three cumulative requirements: holding a recognised primary medical qualification, registration with the GMC, and a licence to practise. Failure to verify any one of these conditions exposes the employing organisation to criminal prosecution for facilitating unlawful practice.

The consequences are not hypothetical:

• In 2023, a UK hospital employed a "surgeon" with fraudulent Romanian qualifications for 18 months, who operated on 43 patients before the trust discovered the fraud
• Each year, regulatory bodies identify dozens of practitioners working with expired accreditations, particularly in locum and agency staffing

The explosion of regulatory complexity

The number of verifications required per practitioner has grown steadily:

• Primary medical qualification and specialty
• Active GMC/NMC registration with licence to practise
• Revalidation status (for doctors, 5-yearly cycle)
• Professional indemnity insurance
• Mandatory and statutory training (safeguarding, BLS, infection control)
• Specialty-specific accreditations (radiation protection, prescribing rights, etc.)

For a hospital trust with 500 practitioners, tracking these 6+ documents per practitioner represents 3,000+ documents with varying expiry dates. A single expired document missed can trigger non-compliance during a CQC inspection.

Locum and agency staffing: a special case

Locum agencies and staffing platforms must verify credentials before every placement. A locum who works 40 shifts per year across 15 different trusts must present their documents each time — unless a centralised platform verifies them continuously and provides an up-to-date compliance attestation.

The 5 types of verification in healthcare settings

1. GMC/NMC register verification

The GMC, NMC (Nursing and Midwifery Council) and other regulators maintain public registers of practitioners. Each registered professional receives a unique registration number.

GMC/NMC register verification confirms:

• The professional's existence on the register
• Their registered specialty
• Their active or inactive status
• Their licence to practise status
• Any conditions, undertakings or fitness to practise findings

2. Primary qualification verification

The primary qualification conditions the right to practise. Verifications cover:

• Qualification authenticity — match between the document provided and the awarding institution's records
• Institution accreditation — a qualification from an unaccredited institution (or unrecognised overseas institution) does not confer the right to practise
• Specialty — for specialist doctors, the CCT (Certificate of Completion of Training) or CESR (Certificate of Eligibility for Specialist Registration) must be verified separately
• IMG (International Medical Graduate) — PLAB test results or acceptable postgraduate qualification, plus GMC registration

For UK qualifications, verification can be done via the university or HEDD. Overseas qualifications require the ECFMG or GMC's own verification process.

Consult our complete guide to healthcare credential verification for detail by profession.

3. Revalidation and CPD obligations

Revalidation is a statutory requirement for all doctors on the GMC register. Every 5 years, the doctor's Responsible Officer (RO) makes a recommendation to the GMC based on an appraisal portfolio covering the full 5-year cycle.

Check points:

• Revalidation date and recommendation status
• Annual appraisal completion
• CPD (Continuing Professional Development) evidence
• Significant event analysis and quality improvement activity

Non-compliance with revalidation can result in withdrawal of the licence to practise.

4. Specialty-specific accreditations

Certain clinical activities require accreditations beyond the primary qualification:

5. Professional indemnity insurance

The Health Care and Associated Professions (Indemnity Arrangements) Order 2014 requires all healthcare professionals to hold appropriate indemnity cover. The employing organisation must verify:

• The existence of the insurance contract
• Its validity at the date of employment
• The adequacy of cover for the activity undertaken
• The absence of exclusions affecting the planned activity

Features of a medical credential verification platform

Connectivity to official databases

The added value of a specialist platform lies in its ability to automatically query sources of truth without manual action by the HR team.

A platform connected to available APIs (GMC, NMC, HCPC) automates register verification in real time. For sources without APIs (universities, overseas bodies), the platform prepares requests, tracks responses and centralises results.

Alert system and expiry tracking

Expiry tracking is the use case where automation generates the most value. A trust with 500 practitioners manages on average:

• 500 professional registration renewals (annual or periodic)
• 500 indemnity insurance attestations (annual renewal)
• 200+ specialty-specific accreditations (1 to 5 year validity)
• 500 mandatory training records (annual to 4-yearly cycles)
• 50-80 visa/immigration documents (for overseas practitioners)

The platform must:

• Automatically extract expiry dates from each document
• Generate a consolidated calendar of deadlines by practitioner and department
• Trigger staggered alerts (90, 60, 30 days before expiry)
• Block allocation of a practitioner whose mandatory document has expired
• Produce a department-level dashboard for clinical leads

Compliance dashboard

The dashboard must serve three audiences:

For the Medical Director / HR Director:

• Overall trust compliance rate (% of practitioners with all documents current)
• Practitioners in anomaly (missing, expired or pending document)
• Compliance history for CQC inspections

For Clinical Leads / Department Heads:

• Department view: who is compliant, who is not
• Alerts on expirations within the next 30 days
• Tracking of locums and agency staff

For the Quality and Governance team:

• Complete audit trail per practitioner
• Data export for CQC inspection
• Process indicators (average verification time, expired document rate)

GDPR and healthcare data compliance

Data collected by the platform (qualifications, accreditations, GMC number) is not health data under Article 4(15) of GDPR, but professional data. However, certain information (disciplinary sanctions for medical reasons, suspension for professional insufficiency) may indirectly reveal health data. The platform must:

• Minimise data collected to what is strictly necessary
• Apply granular access rights (the clinical lead sees compliant/non-compliant status; only the HR Director sees details)
• Host data with a provider compliant with the Data Security and Protection Toolkit (DSPT)
• Respect retention periods (for the duration of the contractual relationship plus applicable limitation periods)

Selection criteria by organisation type

NHS Trust (acute, community, mental health)

• Volume: 200-2,000 practitioners + rotation of trainees and locums
• Priority: CQC compliance, revalidation tracking, IMG verification
• Technical requirement: integration with ESR (Electronic Staff Record) and existing HRIS
• Budget: NHS procurement, framework agreements where applicable

Private hospital / clinic

• Volume: 20-200 practitioners, predominantly consultants with practising privileges
• Priority: verification of consultants exercising practising privileges (no employment relationship)
• Technical requirement: practitioner portal for autonomous document submission
• Budget: rapid decision, ROI expected in 6-12 months

Care home

• Volume: 5-30 practitioners + external visiting professionals (GPs, community nurses, physiotherapists)
• Priority: mandatory training tracking (safeguarding, medication management), DBS checks
• Technical requirement: simplicity of use (small teams, no dedicated IT department)
• Budget: limited, self-service SaaS platform preferred

Locum agency / staffing platform

• Volume: 500-5,000+ practitioners in the pool, recurrent verifications
• Priority: real-time verification before each placement, up-to-date compliance attestation
• Technical requirement: high-performance API (latency < 2 seconds), batch processing
• Budget: per verification, high volume → degressive pricing

Integration with existing healthcare systems

PAS (Patient Administration System) and HRIS

Integration with the hospital information system enables automation of the verification flow at hire and during ongoing employment. Healthcare interoperability standards (HL7 FHIR, IHE profiles) facilitate this integration.

Standard architecture:

1. Practitioner record created in ESR/HRIS → automatic verification trigger via API
2. Verification result → practitioner status update in HRIS
3. Expiry alert → notification in HRIS and allocation block if configured
4. CQC export → automatic generation of compliance data for inspection

Healthcare HR software

Major healthcare HRIS vendors in the UK:

• ESR (Electronic Staff Record) — the NHS national HRIS, integration via standard interfaces
• Allocate/Patchwork — rostering and workforce management, accreditation integration
• Trac — NHS recruitment system, API integration
• HealthRoster — shift planning and competency tracking
• SAP SuccessFactors — for private healthcare groups

Integration must be bidirectional: the HRIS provides practitioner data for verification; the platform returns compliance status and alerts.

Practitioner portal

A self-service portal enables practitioners to:

• Upload their documents (qualifications, certificates, indemnity insurance) securely
• Track their verification status
• Receive reminders for documents approaching expiry
• Download their compliance attestation for other organisations

This portal reduces the HR team's workload and makes practitioners accountable for keeping their own records current.

For technical aspects of API integration, consult our developer integration guide. For a broader view of automated document validation beyond healthcare, consult our dedicated guide.

Frequently asked questions

Is GMC/NMC register verification sufficient to confirm a practitioner can practise?

No. The register confirms professional identity and registration number, but does not detail fitness to practise proceedings in progress, undertakings, or conditions that may restrict practice. A practitioner can appear active on the register whilst under interim conditions imposed by a fitness to practise panel. Direct enquiry to the regulatory body is an essential supplement.

How do you verify an IMG (International Medical Graduate)?

The IMG must hold GMC registration, which requires either passing the PLAB test or holding an acceptable postgraduate qualification. Verify GMC registration status, the existence of a licence to practise, and any conditions. Verification timelines are longer for overseas qualifications, and the process cannot be fully automated.

What is the recommended frequency for re-verification?

CQC expects annual verification of key compliance documents as part of the fit and proper persons requirement. In practice: GMC/NMC registration check annually, indemnity insurance at each renewal (annual), revalidation on the 5-year cycle, mandatory training according to its validity period. The platform automates this calendar based on each document's expiry date.

Does the platform need to be DSPT compliant?

If the platform processes professional data without any link to practitioner health status, DSPT compliance is not legally mandatory. However, certain information (disciplinary sanctions related to health issues, suspension for health-related professional insufficiency) may indirectly constitute health data. As a precaution and to facilitate CQC inspections, DSPT compliance is recommended for healthcare organisations.

Must a locum verified by an agency be re-verified by the trust?

Yes. The employing organisation's (or host trust's) responsibility is engaged independently of verifications conducted by the agency. The trust may request the compliance attestation issued by the agency's platform and supplement it with its own checks (particularly specialty-specific accreditations for the department of assignment).

How does the platform handle mid-contract changes of status?

The platform must monitor trigger events: addition to the list of suspended practitioners, erasure from the register, visa expiry, accreditation lapse. Alerts are sent to HR and the relevant department head. In the case of suspension or erasure, blocking the practitioner's allocation must be immediate.

What is the average cost per practitioner verified?

Cost varies by verification scope: a GMC/NMC register check alone costs £2 to £4 (automated), whilst a complete verification (register + qualification + regulatory body + accreditations) costs £12 to £34 per practitioner. Ongoing monitoring (expiry alerts, periodic re-verifications) adds £4 to £12 per practitioner per year. For a trust with 500 practitioners, the annual budget sits between £8,500 and £21,000, compared with the cost of a dedicated administrative FTE (£28,000 to £38,000 fully loaded).

---

This article is for informational purposes only and does not constitute legal, financial or regulatory advice.

For further reading, consult our guide to healthcare credential verification and our guide to document verification by industry.