Primary Source Verification: What It Is and How Credentialing Teams Automate It

Before a doctor or nurse can see patients or bill an insurer, someone has to confirm that their license, board certification and registrations are real, current and in good standing. Confirming each one with the body that issued it is primary source verification. It sounds simple. In practice it means logging in to hundreds of different websites, each with its own layout, its own rules and its own way of breaking.

This guide explains what primary source verification is, what credentialing teams verify, why the work is slow, what to look for in provider credentialing software, and how to keep the proof an auditor will ask for.

What primary source verification is

A credential is a claim. A provider says they hold a license in a state, are certified by a board, or hold a DEA registration. Primary source verification turns the claim into a confirmed fact by asking the source of record.

A copy of a license, a line on a résumé or an entry in a third-party database is a secondary source. Those can be out of date, wrong or forged. The issuing body is the primary source, which is why accrediting bodies such as NCQA and The Joint Commission set expectations for how credentials are verified. Their standards define which sources count and how recent a check must be, so read the current standard that applies to your organization.

What credentialing teams verify

Programs differ, but most cover the same set of checks:

• State license. Active status, expiry date and any restrictions or disciplinary action, checked with the state licensing board.
• Board certification. Certification status with the certifying board.
• DEA registration. Whether the registration is valid and covers the schedules the provider prescribes, and state controlled substance registrations where they apply.
• Education and training. Medical school, residency and fellowship.
• Work history and references. Gaps and prior affiliations.
• Malpractice history. Including reports from the National Practitioner Data Bank where an organization is eligible to query it.
• Sanctions and exclusions. The OIG exclusion list, SAM.gov exclusions, state Medicaid lists and often the OFAC sanctions list.
• Payer enrollment. Whether the provider is enrolled and active with the payers the group bills.

The exclusion checks are the ones that repeat the most. They are usually run at hire and then every month, which we cover in how often to check the OIG exclusion list, the difference between the federal lists in OIG LEIE vs SAM.gov exclusions, and the state side in state Medicaid exclusion lists.

Why it is slow

The checks themselves are not hard. The sources are.

• There is no common format. Fifty states, national registries, certifying boards, federal lists and payer portals each present their data differently.
• Many need a login. Some require an account, a one-time code sent by text or email, or a manual request.
• Layouts change. A portal redesign or a moved button breaks any script or any team habit that depended on the old page.
• Some sources block automated access. Pages detect scripts and show a challenge instead of the record.
• Proof matters. A check is only useful in an audit if you can show what the source said on the day you looked.

A team doing this by hand spends its time on navigation and copying, not on judgment. That is the part software should take over.

What to look for in provider credentialing software

If you are comparing tools, these questions separate a system that works from one that only looks good in a demo.

Does it check at the source? Ask which sources it reads directly, and which it takes from an aggregated database that may lag.

Does it save proof for every check? The best evidence is a screenshot of the source page plus the fields that matter: license status and expiry, certification status, sanction status and DEA validity.

Does it confirm the proof is right? A screenshot of the wrong page, or of a different provider with the same name, is worse than none. Look for a second check that the page and the provider match.

How does it handle a portal that changes? Every source will change eventually. Ask who finds the cause, who writes the fix, and whether a person approves it before it goes live.

Does it track expiry and re-verify on a schedule? Licenses and registrations lapse, and exclusion lists update every month.

Where does a person step in? Name matches, blocked pages and unusual records need judgment. The system should route them to a reviewer with the evidence attached.

Does it fit your workflow? Results should flow into your credentialing, HR or payer enrollment systems, not into a separate inbox.

Can you scale it? Volume spikes when a group onboards a new site, so ask what happens at ten times your normal load.

How automated verification works

A practical design describes each source in a configuration file instead of writing custom code for every site. The file says how to log in, how to handle a one-time code, how to recognize a blocked page and what proof to capture. The same file can drive production runs, testing and repair, and every version is kept so you can see what changed and when.

When a portal changes, an automated repair step can find the cause and propose a tested fix against the real portal. A person still approves each change before it goes live, so an unattended fix cannot quietly start recording the wrong data. Work is queued by priority, so urgent checks, such as a provider waiting to start, run first.

Keeping the evidence an auditor wants

Whatever system you use, aim to be able to answer these for any provider:

• What was checked, and against which source?
• On what date and time?
• What did the source show? Keep the screenshot and the extracted fields.
• Who or what confirmed it, and was a person involved?
• When is the next check due?

If you can produce that record in seconds, an audit becomes a lookup instead of a scramble.

How we do it

We built and run a provider credentialing verification platform for a US credentialing company. It checks state licensing boards, certification boards, the OIG, OFAC and SAM sanctions lists, DEA registries and payer portals at the source, at about 30,000 verifications a day, using 641 source configurations. Every check saves proof, a second check confirms the page and the provider, and a person approves every repair when a portal changes.

You can try one piece of it yourself. Our free OIG exclusion list search checks up to 25 names at once, and the combined exclusion check searches OIG, SAM.gov and OFAC together.

Talk to us

If your credentialing team spends its week on portals and screenshots, we can help you automate the checks and keep the evidence. Our provider credentialing page shows what the system includes. Contact us and tell us which sources and volumes you handle today.