Primary Source Verification: The 7 Sources Every Payer Requires

Every payer contract, delegation agreement, and accreditation survey rests on one quiet assumption: that the credentials sitting in a provider's file are genuine and were confirmed with whoever issued them. Establishing that is the job of primary source verification (PSV) — confirming a credential directly with the organization that granted it, rather than trusting a photocopy, a line on a CV, or the provider's own attestation. It is the difference between credentialing a physician and merely collecting paperwork about one — the reason PSV sits at the spine of every compliant credentialing program. If you are still untangling how this differs from getting a provider loaded into a health plan's system, start with the distinction between credentialing and payer enrollment.

Both major accreditors define PSV the same way. NCQA's credentialing standards require organizations to verify each element through the primary source itself or a recognized, contracted agent of that source. The Joint Commission, in standard MS.06.01.01, is blunt about what does not count: simply presenting a copy of a license in lieu of evidence that verification was completed does not meet the intent of the requirement. A credential is only verified when the issuing authority — or a recognized equivalent source — confirms it.

In practice, accreditors accept three routes to a verified credential:

• Directly from the issuing source — the state board, the DEA, the medical school, or the specialty board.
• A designated equivalent source — an entity an accreditor has approved as carrying primary-source-quality data, such as the AMA for ABMS board status.
• The National Practitioner Data Bank — recognized for the specific elements it reports, including malpractice payments and adverse actions.

With those rules in place, here are the seven sources a credentialing team must check on every provider — and what each confirms.

1. State licensure

An active, unrestricted license in the state of practice is the non-negotiable floor of credentialing, so it is verified directly with the state medical or nursing board that issued it. The team captures not just that a license exists, but its status, expiration date, and any restrictions or disciplinary flags attached to it. For physicians, the Federation of State Medical Boards operates the Federation Credentials Verification Service, which builds a permanent, primary-source-verified credential profile that boards and hospitals accept as PSV. A common trap: the National Practitioner Data Bank cannot be used to verify licensure. As HRSA guidance on the NPDB makes clear, licensure and its expiration date must be confirmed through the state board itself, not inferred from a Data Bank report. Because licenses lapse and boards act between cycles, status and expiration are tracked on an ongoing basis, not just at reappointment.

2. DEA registration and controlled-substance authority

Any provider who prescribes, administers, or dispenses controlled substances needs a current registration with the Drug Enforcement Administration. Per the DEA Diversion Control Division, practitioners register on DEA Form 224, and the registration is tied to a specific address and set of drug schedules. Verification confirms the number is active, unexpired, and matches the practitioner and location on file, and flags any surrendered or revoked registrations. Registration is only half the picture: many states require a separate state controlled-substance registration (often called a CSR or CDS) layered on top of the federal DEA number, and each has to be verified with the state authority that issues it. A provider can hold a valid DEA registration and still be barred from prescribing in a given state if the state-level registration is missing or expired.

3. Education, training, and the ECFMG pathway

Credentialing confirms that the provider actually completed the medical or professional education and postgraduate training they claim, verified with the degree-granting school and the residency or fellowship program. For international medical graduates, the ECFMG is the gatekeeper: it verifies each IMG's medical diploma directly with the officials of the issuing medical school and certifies the graduate before they can enter U.S. graduate medical education. One nuance from Joint Commission guidance: verifying a current license can, in defined circumstances, satisfy education verification, because the board had to confirm that education before granting the license. Even so, most payers expect the highest level of training relevant to the requested privileges to be verified in its own right, so this element is rarely skipped in a robust file.

4. Board certification

Board certification is verified with the certifying body itself. For physicians, that means the relevant member board of the American Board of Medical Specialties, whose certification data is recognized by the Joint Commission, NCQA, and URAC as satisfying PSV. Because pulling verifications one board at a time is impractical at scale, accreditors also permit designated equivalent sources: the AMA Physician Profile is an official designated equivalent source for ABMS board status, and its underlying professional data is primary-source verified and accepted by CMS, the Joint Commission, DNV, and AAAHC. Verification captures the specialty, certification status, and expiration date where the certificate is time-limited — a detail that matters because lapsed certification can quietly undercut the privileges granted on the strength of it.

5. Work history and hospital affiliations

NCQA's standards require organizations to collect and review a practitioner's work history — commonly the most recent five years — and to reconcile any gaps in that timeline. This is where credentialing shifts from confirming documents to constructing a coherent picture of where the provider has actually practiced. Current and prior hospital affiliations and privileges are verified with those institutions, which is also how a team surfaces resignations under investigation or privileges that were denied, limited, or not renewed. Much of the raw data starts with the provider's self-reported profile and attestation, typically maintained through the CAQH ProView attestation cycle, but self-reported history is a starting point, not verification — every affiliation and unexplained gap still has to be confirmed against the institutions and dates involved.

6. Malpractice history and the National Practitioner Data Bank

Malpractice and adverse-action history is one of the most consequential things a credentialing file confirms, and its authoritative source is the National Practitioner Data Bank. Established under the Health Care Quality Improvement Act of 1986 and codified at 45 CFR Part 60, the NPDB collects reports of medical malpractice payments, adverse licensure actions, clinical privilege actions, and certain other sanctions. Organizations query it as part of credentialing, often through an authorized agent registered with the Data Bank. It is critical to understand what the NPDB is and is not: HRSA describes it as an alert or flagging system meant to be used in conjunction with — not in place of — other sources. A query points toward issues to investigate; the provider's malpractice carrier and prior insurers fill in the claims detail. Our walkthrough of how NPDB queries actually work covers the one-time versus continuous query mechanics in depth.

7. Sanctions and exclusions

The final source confirms the provider is legally eligible to participate in federal health care programs at all. Two federal databases anchor this check:

• The OIG List of Excluded Individuals/Entities (LEIE) — per the HHS Office of Inspector General, excluded parties can receive no payment from federal health care programs for any items or services they furnish, order, or prescribe, and the OIG recommends screening the LEIE monthly.
• SAM.gov exclusions — the System for Award Management captures government-wide debarments and suspensions that reach beyond the health care programs alone.

Because a provider can be excluded the day after a clean check, this is not one-and-done. NCQA's standards push exclusion screening into ongoing monitoring rather than a point-in-time snapshot, and most teams add applicable state Medicaid exclusion lists. For the cadence and record-keeping that keep this defensible, see our guide to continuous OIG and SAM exclusion monitoring.

How verification is accepted — and documented

Checking the seven sources is only half of PSV; proving you checked them is the other half. The Joint Commission expects the file to show, for each verified element, the date the verification was performed, who performed it, exactly what was verified, and the result. A verification with no date and no attribution is, for audit purposes, no verification at all. That is why many organizations route this work through a credentials verification organization; our overview of what a CVO does lays out where a contracted agent fits within the accreditor's definition of an acceptable source.

Held together, the seven sources answer seven distinct questions: is the provider licensed, are they authorized to handle controlled substances, are they trained, are they certified, where have they practiced, what does their malpractice and adverse-action record show, and are they eligible to bill federal programs. Miss one and the file has a hole a payer audit will find. Verify all seven from the primary source, keep every verification dated and attributed, and monitor the elements that change between cycles, and you have a file that survives scrutiny — the standard our checklist for an audit-ready credentialing file is designed to help you hit on every provider.