Healthcare Credential Verification: NCQA, Joint

Every hospital, health system, ambulatory care center, and managed care organization in the United States must verify the credentials of healthcare practitioners before they treat patients. The Joint Commission and NCQA (National Committee for Quality Assurance) mandate comprehensive credentialing processes that include primary source verification of medical licenses, board certifications, DEA registrations, education, training history, and malpractice history. Failure to complete these checks can result in loss of accreditation, exclusion from Medicare and Medicaid programs, malpractice liability, and — in severe cases — criminal prosecution for negligent credentialing.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Consult a healthcare attorney or credentialing specialist for situation-specific guidance.

The Regulatory Framework for Healthcare Credential Checks

Healthcare professional credentialing in the United States operates through a multi-layered system of federal requirements, state licensing boards, and accreditation body standards. Each layer imposes specific verification obligations.

State medical boards — one per state, plus the District of Columbia and territories — issue and manage physician licenses. Each state board maintains a public verification portal. The Federation of State Medical Boards (FSMB) provides a centralized verification service across all state boards.

The National Practitioner Data Bank (NPDB), operated by the Health Resources and Services Administration (HRSA), is the federal repository for reports on medical malpractice payments, adverse licensing actions, adverse clinical privilege actions, and exclusion from federal healthcare programs. NPDB queries are mandatory for credentialing and recredentialing.

The Drug Enforcement Administration (DEA) registers practitioners authorized to prescribe controlled substances. DEA registration verification is required for any provider who will prescribe or dispense controlled substances.

CMS (Centers for Medicare and Medicaid Services) sets conditions of participation for hospitals and healthcare facilities receiving Medicare/Medicaid reimbursement. CMS Conditions of Participation (42 CFR 482.12, 482.22) require organized medical staff credentialing with defined criteria for privileges.

The Joint Commission accredits over 22,000 healthcare organizations in the US. Its Medical Staff Standards (MS.06.01.01 through MS.06.01.05) define specific credentialing requirements that exceed CMS minimums.

NCQA accredits managed care organizations and health plans. Its Credentialing and Recredentialing Standards (CR Standards) are the industry benchmark for health plan credentialing processes.

The Office of Inspector General (OIG) maintains the List of Excluded Individuals/Entities (LEIE), and the System for Award Management (SAM.gov) maintains the federal exclusion list. Both must be checked during credentialing.

Which Checks Are Required for Each Professional Type

The scope of verification varies by profession, role, and organizational setting. The table below summarizes the mandatory checks for the main healthcare roles in the United States.

All practitioners who prescribe controlled substances require DEA registration verification. Board certification verification through the relevant specialty board (ABMS member boards for physicians, NCCPA for PAs, AANP/ANCC for NPs) is standard practice even where not strictly mandated.

Step-by-Step Verification Process

The Joint Commission and NCQA define a credentialing process that must be completed and documented before the practitioner begins treating patients. Provisional privileges may be granted under defined conditions, but full credentialing must be completed within the specified timeframe.

Step 1: Application and Attestation

The practitioner completes a credentialing application — typically the CAQH ProView universal application or an organization-specific form — attesting to their education, training, licensure, certifications, malpractice history, health status, and any disciplinary actions. The application includes an attestation statement that the information is complete and accurate.

Step 2: Primary Source Verification of Licensure

The credentialing office verifies the practitioner's current medical license directly with the issuing state board. For physicians, the FSMB provides a centralized verification service. For nurses, the Nursys verification system covers participating state boards. Primary source verification means confirmation directly from the issuing authority — not from the practitioner's CV or a photocopy of the license.

Step 3: Education and Training Verification

Medical school graduation, residency completion, and fellowship training must be verified at the primary source. For physicians, this means confirmation from the medical school and training program. The AMA Physician Masterfile and the ECFMG (Educational Commission for Foreign Medical Graduates) provide verification services for US and internationally trained physicians respectively.

Step 4: Board Certification Verification

Board certification status is verified through the relevant certifying body. For physicians, the American Board of Medical Specialties (ABMS) and its member boards provide certification verification. NCQA requires verification of board certification status — including whether the practitioner has board certification, is board-eligible, or has neither.

Step 5: NPDB Query

A mandatory query to the National Practitioner Data Bank reveals any malpractice payments, adverse licensing actions, adverse clinical privilege actions, Medicare/Medicaid exclusions, and other reportable actions. NPDB queries are required at initial credentialing and every two years at recredentialing. The Joint Commission requires continuous querying through NPDB's Continuous Query enrollment for proactive monitoring between credentialing cycles.

Step 6: DEA Registration Verification

For practitioners who will prescribe or administer controlled substances, the credentialing office verifies active DEA registration through the DEA Diversion Control Division. The DEA number, schedules authorized, and expiration date must be confirmed and documented.

Step 7: OIG/SAM Exclusion Check

The credentialing office checks the OIG List of Excluded Individuals/Entities (LEIE) and SAM.gov to confirm the practitioner is not excluded from federal healthcare programs. Employing or contracting with an excluded individual results in civil monetary penalties of up to $100,000 per item or service and potential exclusion of the organization itself.

Step 8: Malpractice Insurance Verification

Current professional liability insurance coverage is verified, including carrier name, policy number, coverage limits, and effective dates. Most healthcare organizations require minimum coverage of $1 million per occurrence / $3 million aggregate.

Step 9: Work History and References

A minimum of five years of work history must be verified, with gaps explained. Peer references from practitioners in the same or similar specialty are required — typically two to three references who can attest to current clinical competence.

Step 10: Committee Review and Privileging

The completed credentialing file is reviewed by the medical staff credentials committee (or equivalent body), which makes a recommendation to the governing board. Privileges are granted for specific procedures and clinical activities based on the practitioner's training, experience, and demonstrated competence.

Internationally Trained Practitioners: Additional Requirements

The United States relies significantly on internationally trained healthcare professionals. According to AAMC workforce data, approximately 25% of practicing physicians in the US are international medical graduates (IMGs).

For physicians, the pathway involves ECFMG certification (which requires passing USMLE Steps 1 and 2), completion of an ACGME-accredited residency program, and state medical board licensure. Specialists must complete fellowship training and pass board certification examinations.

For nurses, the pathway involves credential evaluation through CGFNS (Commission on Graduates of Foreign Nursing Schools), passing the NCLEX-RN examination, and state board licensure. English language proficiency must be demonstrated.

Credentialing offices must verify that each stage has been completed and retain evidence. Relying solely on the practitioner's self-declaration is not acceptable under Joint Commission or NCQA standards.

Consequences of Inadequate Credential Verification

The Joint Commission's Sentinel Event database consistently identifies credentialing failures as a contributing factor in serious patient safety events. Negligent credentialing — granting privileges to a practitioner who should not have received them — is one of the most common theories of liability in healthcare malpractice litigation.

The OIG imposed over $2.5 billion in enforcement actions in fiscal year 2024, with a significant portion involving organizations that failed to properly verify practitioner credentials or employed excluded individuals.

Clinical incidents involving improperly credentialed practitioners can trigger investigation by the state medical board, CMS, the Joint Commission, and potentially the FBI (for healthcare fraud). The employing organization faces negligence claims, loss of accreditation, exclusion from Medicare/Medicaid, and reputational damage. Individual administrators can be held personally liable for negligent credentialing decisions.

Insurance implications are severe. Medical malpractice insurers require that practitioners hold valid licensure and that organizations follow established credentialing processes. Treatment delivered by an improperly credentialed practitioner may void the organization's coverage, leaving it exposed to the full cost of claims — which in the US healthcare system can run into tens of millions of dollars.

Loss of Joint Commission accreditation triggers an automatic review of CMS deemed status, potentially leading to exclusion from Medicare and Medicaid reimbursement — a financial catastrophe for most healthcare organizations.

Automating Healthcare Credential Verification

Manual credential checking across state licensing boards, NPDB, DEA, OIG/SAM, specialty boards, and education verification services is time-intensive and error-prone. A typical hospital credentialing office processing 300 practitioners per year spends an estimated 2,000 hours annually on credentialing and recredentialing — equivalent to one full-time employee dedicated solely to verification tasks.

The average time to credential a new practitioner is 90-120 days using manual processes. During this period, the practitioner cannot see patients, creating significant revenue loss and staffing gaps — particularly acute in the current healthcare workforce shortage.

A document verification platform can automate the extraction and validation of medical licenses, board certifications, DEA registrations, and educational credentials. Integration with primary source databases — state medical boards, FSMB, NPDB, ABMS, OIG/LEIE, SAM.gov, and DEA — enables real-time status confirmation. Automated expiry tracking ensures that license renewals, DEA registrations, and recredentialing deadlines are flagged before they lapse.

Combined with HR document verification workflows and identity verification technology, healthcare organizations can reduce credentialing time from months to weeks while maintaining full audit trails for Joint Commission surveys, NCQA reviews, and CMS Conditions of Participation surveys.

Request a demo for healthcare document verification

For a comprehensive overview, see our industry document verification guide. Our data from over 180,000 documents processed monthly across regulated sectors shows a 94.8% fraud detection rate and an average verification time of 4.2 seconds, reducing manual credential review time by 83%.

Frequently Asked Questions

Can I rely solely on state licensing board websites to verify a practitioner?

State board websites confirm current license status, disciplinary actions, and restrictions. They do not verify the authenticity of educational credentials, residency training, board certification, malpractice history, or federal program exclusion status. Joint Commission and NCQA standards require primary source verification of multiple credential elements — the state license check is necessary but not sufficient on its own.

How often should credential checks be repeated for existing staff?

Joint Commission and NCQA standards require recredentialing every two years, including a new NPDB query. Between cycles, organizations should monitor for changes using NPDB Continuous Query, OIG/SAM monthly checks, and state board alert services where available. Best practice is to run exclusion checks monthly and license status checks quarterly. CMS Conditions of Participation require ongoing monitoring, not just point-in-time credentialing.

What happens if a practitioner's license lapses after they have started work?

A practitioner whose license lapses must stop practicing immediately. Practicing medicine without a valid state license is a criminal offense in all 50 states. The organization must have systems to detect lapsed licensure — typically through automated alerts linked to state board databases or a document management platform that tracks expiration dates. The Joint Commission requires that organizations have a process to address situations where a practitioner's licensure, certification, or clinical privileges are adversely affected.

Are locum tenens and temporary staff subject to the same checks?

Yes. CMS Conditions of Participation and Joint Commission standards apply regardless of employment arrangement. The healthcare organization retains ultimate responsibility for ensuring all credentialing requirements are met for every practitioner who exercises clinical privileges, whether employed directly, contracted through a locum tenens agency, or working as an independent contractor. Agencies should provide credentialing files, but the organization must independently verify that all primary source verifications are current and complete.

Does CheckFile.ai support healthcare credential verification?

CheckFile.ai automates the verification of medical licenses, board certifications, DEA registrations, educational credentials, and identity documents for healthcare practitioners. The platform extracts key data, detects document anomalies, and generates compliance reports suitable for Joint Commission surveys, NCQA reviews, and CMS examinations. See pricing for healthcare organizations.