Not All Verification Is Primary Source Verification

Primary source verification is one of the most important responsibilities in the credentialing process. It is also one of the most misunderstood.

Most credentialing deficiencies do not occur because organizations completely fail to verify information. More often, the wrong source was used, documentation was incomplete, or teams relied on information they believed met accreditation expectations when it did not.

The operational risk is not simply a survey finding.

Primary source verification supports the decisions organizations make about who is permitted to provide care. When verification practices become inconsistent, leadership loses confidence in the integrity of the credentialing process, providers can experience delays, applications can remain incomplete longer than necessary, and organizations may struggle to defend credentialing decisions during accreditation surveys, audits, or investigations.

Strong credentialing programs do not rely on assumptions.

They rely on documented verification from accepted primary or primary source equivalent sources.

Mistake #1: Assuming a Provider Document Is Verification

One of the most common mistakes occurs when organizations treat provider-supplied documents as verification.

Examples include:

• Copies of state licenses
• Copies of board certificates
• Copies of DEA registrations
• Copies of diplomas
• Printed résumés or CVs

These documents may support the file, but they do not replace verification from the source responsible for issuing or maintaining the information.

Operationally, this creates two risks.

First, there is no independent confirmation that the information remains current.

Second, the organization may be unable to demonstrate that verification actually occurred if questioned during a survey or audit.

Credentialing requires evidence, not assumptions.

Mistake #2: Not Understanding What AMA Can Verify

Many credentialing professionals are familiar with AMA Physician Profiles but do not fully understand the amount of primary source verified information contained within them.

According to the AMA, Physician Profiles include primary source verified information for:

• Medical education
• Graduate medical education
• ABMS board certification
• State licensure
• DEA registration
• National Provider Identifier (NPI)
• ECFMG applicant information
• State and federal sanctions

The AMA also states that specific elements of AMA Physician Professional Data are accepted by organizations including CMS, The Joint Commission, AAAHC, DNV, HFAP, and NCQA for applicable primary source verification requirements.

Resources:

• AMA Physician Profiles FAQs [ama-assn.org]
• AMA Initial and Reappointment Profiles [ama-assn.org]

The operational risk is not understanding what has already been verified versus what still requires additional review. Organizations often perform unnecessary duplicate work in some areas while inadvertently overlooking others.

Mistake #3: Assuming Board Certification Was Verified Somewhere Else

Board certification creates frequent confusion.

A provider lists a certification on an application. The information appears on a CV. It may even appear in an AMA Profile.

The mistake occurs when organizations cannot clearly demonstrate where the certification was verified.

The American Board of Medical Specialties maintains certification information that is recognized by multiple accrediting organizations as satisfying primary source verification requirements for board certification.

Resource:

• ABMS Verify Certification [abms.org]

The operational risk is not simply missing documentation. Board certification often plays a role in privileging decisions, payer enrollment, specialty recognition, and patient confidence. Organizations should be able to identify exactly when certification was verified and from what source.

Mistake #4: Treating State Licensure as a One-Time Event

Many organizations verify licensure appropriately during initial credentialing.

The exposure develops later.

Questions credentialing leaders should ask include:

• Is licensure being monitored continuously?
• Are expiration dates tracked proactively?
• Are disciplinary actions reviewed?
• Is reverification occurring according to organizational policy?

State licensing boards remain the authoritative source for current licensure status, restrictions, disciplinary actions, and expiration information.

The operational risk is straightforward. A strong initial credentialing process does not protect an organization if ongoing monitoring is inconsistent.

Most organizational exposure develops after the initial credentialing decision has already been made.

Mistake #5: Documenting a DEA Number Instead of Verifying DEA Registration

DEA verification is frequently misunderstood.

Many files contain a DEA number.

That does not necessarily mean DEA registration was verified.

The Drug Enforcement Administration maintains registration validation resources for verification purposes.

Resources:

• DEA Registration Validation
• DEA Registration Validation Information

The operational risk extends beyond credentialing.

Medication management, prescribing authority, controlled substance oversight, regulatory compliance, and patient safety may all be affected when DEA information is not properly validated.

A documented DEA number and a verified active DEA registration are not the same thing.

Mistake #6: Treating OIG Screening as a Routine Checkbox

Organizations often perform OIG screening because policy requires it.

The stronger question is why it matters.

The Office of Inspector General maintains the federal List of Excluded Individuals and Entities (LEIE), which organizations use during screening and monitoring activities.

Resource:

• https://exclusions.oig.hhs.gov/

The operational consequences of missed exclusions can be significant.

Potential impacts may include:

• Reimbursement exposure
• Compliance investigations
• Audit findings
• Repayment obligations
• Increased organizational scrutiny

The mistake is not forgetting to run a search.

The mistake is treating exclusion screening as a routine administrative task rather than an organizational risk management activity.

Mistake #7: Failing to Document the Verification

Sometimes verification occurs correctly.

Documentation does not.

Organizations should consistently document:

• Verification date
• Verification source
• Individual performing verification
• Verification results
• Any follow-up activity

Surveyors, auditors, and accrediting organizations generally evaluate evidence.

If the organization cannot demonstrate when and how verification occurred, it becomes difficult to defend the process.

The operational risk is that accurate work becomes difficult to prove.

Mistake #8: Never Reviewing Trends

Credentialing teams are often focused on completing files.

Strong organizations also evaluate patterns.

For example:

• Are the same verifications repeatedly delayed?
• Are certain sources creating bottlenecks?
• Are providers submitting incomplete applications more often?
• Are exceptions becoming routine?
• Are reverification activities consistently late?

A single deficiency may be isolated.

A recurring deficiency often indicates a process issue.

Trend monitoring helps organizations identify workflow weaknesses before they become survey findings, provider delays, accreditation concerns, or operational disruptions.

Final Thought

Primary source verification is often viewed as a documentation requirement, but the real purpose is much broader. It is the process organizations use to confirm that the information supporting credentialing decisions is accurate, current, and defensible. When verification is incomplete, inconsistent, or performed from the wrong source, the risk extends beyond a survey finding. Delayed appointments, incomplete credentialing files, reimbursement exposure, regulatory scrutiny, and challenges defending credentialing decisions can all follow. Most primary source verification failures do not begin with a missing license check or an overlooked document. They begin with assumptions. A provider-supplied document is assumed to be enough. A previous verification is assumed to still be valid. A certification is assumed to have already been confirmed. Strong credentialing programs replace those assumptions with consistent, documented verification from accepted primary or primary source equivalent sources. That discipline strengthens survey readiness, supports patient safety, improves organizational confidence in credentialing decisions, and reduces risk long before a surveyor, auditor, or regulator ever reviews the file.