Primary source verification (PSV) is the non-negotiable core of credentialing. "Primary source" means you verify a credential with the organization that issued it — not a copy the provider hands you, not a résumé line. NCQA, URAC, and The Joint Commission all require it, and payers won't enroll a provider whose file isn't built on it.
Here are the seven sources that get checked on essentially every U.S. provider, and what each one confirms.
1. State licensing board
Confirms an active, unrestricted license to practice in each state where the provider will see patients. This is verified per state — a provider working telehealth across five states needs five verifications, each against that state's board.
2. NPPES (National Plan & Provider Enumeration System)
Confirms the provider's NPI (National Provider Identifier) and that the demographic data on file matches. The NPI is the universal key that links a provider across every payer and claim.
3. DEA / CDS registration
For providers who prescribe controlled substances, confirms a valid DEA registration (and state Controlled Dangerous Substance registration where required). Verified against the DEA's records.
4. Board certification
Confirms specialty board status with the certifying board (ABMS member boards, AOA for osteopathic, or the relevant specialty board). Verifies the certification is current and not expired.
5. Education & training
Confirms medical/professional school graduation and completion of residency/fellowship, verified with the institutions or an approved verification service (e.g., ECFMG for international medical graduates).
6. NPDB (National Practitioner Data Bank)
A federal query that surfaces malpractice payments, adverse licensure actions, clinical privilege restrictions, and certain sanctions. A continuous-query enrollment keeps it monitored rather than checked once.
7. OIG LEIE + SAM.gov exclusions
Confirms the provider is not excluded from federal healthcare programs (OIG List of Excluded Individuals/Entities) and not debarred from federal contracting (SAM.gov). Billing for an excluded provider is a serious compliance violation — this is checked at onboarding and re-swept monthly.
The operational reality
Each of these has a different source system, a different interface, and a different refresh cadence. Done by hand, building one provider's PSV file is hours of portal-hopping and PDF-wrangling. Done continuously — so a newly-surfaced sanction or an expiring license triggers an alert the day it changes — it's a system, not a task.
See your own numbers in 60 seconds
CredTek gets providers in-network 40–60% faster — built by operators with 40+ years of enterprise credentialing experience, run by modern AI agents with a human approval gate on every submission.
Run the ROI calculator →