The Importance of Primary Source Verification in Provider Credentialing

Provider credentialing—the process of obtaining, verifying, and assessing the qualifications of a clinician to provide care or services—is risky business for health systems and payers alike. Improper credentialing can directly jeopardize patient safety and result in a negligent credentialing lawsuit. At the center of every credentialing effort: primary source verification.

Consider this example of the dire consequences of failing to properly vet a provider's credentials through primary source verification:

A spinal surgeon in Ohio is the subject of several hundred medical malpractice lawsuits alleging that he performed improper and medically unnecessary procedures. One former patient continued to suffer from back pain after two surgeries performed by the physician, whom the patient claims used a bone morphogenetic protein product off-label and without her consent.

In one combined appeals case, five former patients claimed that the hospital involved negligently credentialed, supervised, and retained him as a credentialed physician. The patients allege that the hospital and the payer organizations that listed him on multiple panels:

1) Failed to adequately evaluate his educational background, work history, and peer reviews when he applied 

2) Knew about his fraudulent scheme but continued granting him privileges and access to patients/members

3) Ignored complaints about him from staff, doctors, and patients

Although the Ohio Appellate Court dismissed this case because the negligent credentialing claims were filed too late—outside the four-year medical malpractice statute of repose—the hospital and insurer still incurred legal costs and suffered reputational damage.


As this example illustrates, verifying the accuracy of a practitioner’s credentials is critical, especially when that individual is new to the healthcare organization. A typical practitioner applying for a medical staff position provides a considerable amount of information—proof of licensure, certifications, education details, references, insurance information, etc.—that the credentialing or enrollment professional must evaluate.

To protect patients and prevent negligent credentialing lawsuits, hospitals and healthcare facilities use primary source verification as a credentialing industry standard. Since secondary sources of information might be inaccurate, unreliable, or biased, going directly to the original source of information will give you the confidence that you have an accurate picture of a provider's training, experience and current competence.

What credentials require primary source verification?

The Joint Commission, the primary accreditor of most U.S. hospitals and health systems, requires accredited healthcare organizations to use primary sources to verify certain credentials, including:

  • Medical school diplomas
  • Specialty training or residency certificates
  • Licenses to practice
  • Registration with a medical or dental council or any other credential required by law, regulation or hospital policy
  • Any credentials issued by recognized education or professional entities as the basis for clinical privileges

The Joint Commission does not require other credentials, such as professional history, letters of recommendation, criminal background checks, identification verification, immigration, and financial documents to be verified from the primary source, unless required by hospital policy. However, The it recommends that hospitals use primary source verification for these credentials, too, as a best practice and to prevent appointing a practitioner who provided fraudulent credentials.

For payer organizations, the National Committee for Quality Assurance (NCQA) leads the way when it comes to setting quality standards regarding primary source verification.

What's considered a primary source?

A primary source is the body, organization, or person who issued the information under review. These sources would have direct knowledge of  the validity of information stated by the practitioner. Alternatively, a designated equivalent verification source specified by your accreditation choice (for example, The Joint Commission) can be used. In some situations, the primary source may rely on a third party to provide verification of a practitioner’s credentials. Such is the case when a state licensing agency designates verification through AIM Docfinder as primary source.

Issuing body

When it comes to licensure, certifications, education, training history, and professional affiliations,  the issuing body is the primary source. These can include:

Federal and state government agencies  

  • Licensure
  • Sanctions
  • National Practitioner Data Bank (NPDB)
  • State certifications
  • Controlled substance/narcotics certification
  • Background checks
  • Criminal history
  • Military personnel records

Education institutions

  • Medical school and post-graduate training records


  • Experience and work history
  • Privileges granted

Professional associations

  • Affiliations
  • Professional certifications


Whenever information supplied by a provider involves a personally written peer reference or confirmation,  you must locate and communicate directly with that individual to:

  • Ask questions to corroborate and verify the accuracy of what they wrote, and confirm that this individual, in fact, had the necessary familiarity with the provider to make a professional assessment or recommendation.
  • Dig deeper into the individual's relationship with the provider and decide whether the relationship is acceptable according to your organization's bylaws and credentialing policies.


Getting accurate documentation of experience, training, and current competence can be difficult and time consuming. Keep in mind that the practitioner is responsible for providing accurate source contact information. When your attempts to locate the individual are unsuccessful, going back to the practitioner for corrected contact information is appropriate.

Designated equivalent sources

As noted, in some cases, you can get verification from a source that is not the primary source but is still considered its equivalent (i.e., as accurate as the original issuing body).

The Joint Commission accepts these (and other) designated equivalent sources for credentials verification:

  • The American Medical Association (AMA) Physician Masterfile for verification of a physician’s U.S. and Puerto Rican medical school graduation and postgraduate education completion; this database contains provider data which has been obtained directly from the primary sources
  • The American Board of Medical Specialties (ABMS) for verification of a physician’s board certification
  • The Educational Commission for Foreign Medical Graduates (ECFMG) for verification of a physician’s graduation from a foreign medical school
  • The American Osteopathic Association (AOA) Physician Database for pre-doctoral education accredited by the AOA Bureau of Professional Education, post-doctoral education approved by the AOA Council on Postdoctoral Training, and Osteopathic Specialty Board Certification
  • The American Academy of Physician Assistants (AAPA) Profile for physician assistant education, provided through the AMA Physician Profile Service
  • The Federation of State Medical Boards (FSMB) Disciplinary Action Databank for all actions against a physician’s medical license

In addition, some organizations will designate an agent to handle verification requests on their behalf. For instance, in its list of Official ABMS Display Agents, the American Board of Medical Specialties has authorized symplr Provider (formerly Cactus and eVIPs) to supply ABMS data through their credentialing solutions. According to an ABMS statement, reports provided through Display Agents products or services are considered primary source and meet the verification requirements established by The Joint Commission and other accreditation organizations.

A designated equivalent source, if available, can be a convenient way for credentialing professionals to quickly verify a provider's information while having complete confidence in that source's accuracy.

The verification process

Method of contact

The method you use to contact a primary source will depend on a number of factors. Typically, you would obtain verification in writing, through telephone verification, or through a website.

A written verification can take the form of a letter, fax, or email. While this may be the most time-consuming method, it provides a written record that can be kept on file. Plus, making your request in writing may be the only way to reach some organizations or individuals.

If you are verifying information with a primary source by phone, including the following details will provide a well-documented record of the call:

  • Name of the organization
  • Date contacted
  • Person contacted
  • Phone number of person contacted
  • Questions asked
  • Question responses
  • Name of the person responding
  • Name and signature/initials of person collecting the verification information
  • Date the verification was completed


When verifying credentials through the website of a primary or designated equivalent source, be sure to capture the following information if the printed copy of the webpage will serve as your record:

  • Practitioner’s name and any relevant identifying information (e.g., date of birth)
  • Confirmation verifying the practitioner’s credential and related details
  • The URL of the webpage
  • Date verified
  • Initials of the individual conducting the verification

When to use a secondary source

You won't always be able to verify information directly from a primary source. Organizations and hospitals close, offering no way to verify the accuracy of documentation they had previously issued. Verification of credentials received from international institutions may be challenging as well, and in some cases impossible. For example, records may have been lost in a natural disaster.

In these situations, you should make—and document—a credible effort to verify the credentials. This means making multiple attempts (at least two within 60 days) to verify the credentials using primary sources—and documenting your attempts and the results. If your attempts are unsuccessful, you should verify education and licensure through the licensing board or a designated equivalent source. According to The Joint Commission, when the educational institution is no longer in existence and the information does not appear on the AMA profile or ECFMG, verification of licensure would suffice since the licensing board would have had to verify the education before granting the license.

When primary source verification is impossible, finding relevant and reliable secondary sources – while a challenge – will be your best option.

Secondary source verification can include:

  • Written statements from the leadership of successor organizations
  • In cases of a hospital closure, determining where the original documents were sent
  • Contacting other hospitals in a closed facility's area to see if anyone on staff can offer primary source verification


When all else fails, doing a little detective work can usually yield individuals who can verify documentation with a high degree of accuracy.

Whether you verify provider information from original sources, use a designated equivalent, or uncover a knowledgeable secondary source, going the extra mile to ensure the accuracy of provider credentials will safeguard the integrity of your credentialing process, protect your patients, and reduce your legal risk.

By outsourcing provider credentialing to a Credentials Verification Organization (CVO), your healthcare organization can streamline and automate credentialing processes, onboard providers faster so they can see patients and get reimbursed sooner, and reduce the likelihood of noncompliance, inaccuracy, and increased audits that drain financial resources.


Request a Demo