Primary Source Verification: Building a Bulletproof Credentialing Workflow

:::info Quick answer Primary source verification (PSV) is the process of confirming a provider's credentials—such as medical licenses, board certifications, and education—directly with the issuing organization. Payers and regulators require PSV to prevent fraud, meaning you cannot legally or contractually rely on photocopied certificates provided by the applicant. :::

You hire a brilliant new orthopedic surgeon in October 2026. You collect her CV, a pristine PDF of her state medical license, her DEA certificate, and her diploma. She starts seeing patients, you bill $150,000 in her first month, and everything looks great.

Six months later, UnitedHealthcare demands a full refund. Medicare issues a revocation notice. Why? That pristine PDF was doctored. She let her actual license lapse three months before you hired her, and you relied on a photocopy.

This is why primary source verification exists. In the medical billing and credentialing world, we operate on a zero-trust model. If you did not hear it directly from the entity that issued the credential, it does not exist.

As payer scrutiny hits all-time highs in 2026 and the Office of Inspector General (OIG) aggressively pursues False Claims Act violations for excluded providers, your credentialing workflow is your practice's first line of financial defense.

Why "Copies" Don't Cut It (The NCQA and URAC Reality)

The National Committee for Quality Assurance (NCQA) and URAC write the rulebooks for how commercial payers handle credentialing. When you sign a contract with Aetna, Cigna, or Blue Cross Blue Shield, that contract dictates that any provider billing under your tax ID must be credentialed according to NCQA standards.

The foundational rule of these standards is primary source verification. You cannot accept a secondary source. A secondary source is any intermediary that didn't generate the original data. If a doctor hands you an envelope with their medical school transcript, that is a secondary source (because it passed through the doctor's hands). If you log into the American Medical Association (AMA) Physician Masterfile, that is a recognized primary source equivalent.

Failing to verify credentials directly at the source leads to catastrophic revenue cycle failures. Claims deny outright with codes like CO-8 (The procedure code is inconsistent with the provider's state license/certification) or CO-B7 (This provider was not eligible to be paid for this procedure/service on this date). Worse, if a payer audits your files and finds gaps in your PSV, they can terminate your network contract completely.

The 6 Non-Negotiable Primary Sources in 2026

Building a compliant PSV workflow means knowing exactly where to go for each piece of a provider's background. Here are the required sources and how to query them today.

1. State Medical Boards and Licensure

A provider must hold an active, unrestricted license in the state where the patient is located at the time of service. You verify this directly on the state medical board's website or via their official API.

In 2026, the rise of the Interstate Medical Licensure Compact (IMLC) has complicated this. A physician might hold a primary license in Nevada but use the Compact to get expedited licenses in Utah and Idaho. You must perform primary source verification for every single state where that provider holds an active license, not just their primary practice location. Check for any disciplinary actions, letters of reprimand, or probationary statuses.

2. DEA and Controlled Substance Registrations

If a provider prescribes medications, they need a Drug Enforcement Administration (DEA) registration, and in many states, a localized Controlled Dangerous Substances (CDS) certificate.

You verify the DEA registration through the U.S. Department of Justice DEA Diversion Control Division portal. Check the expiration date, the authorized drug schedules (II through V), and ensure the address on the DEA certificate matches the physical location where the provider actually practices. Payers will halt credentialing if the DEA address points to a residential home or an old employer across the country.

3. Board Certification (ABMS vs. AOA)

Most commercial payer contracts require providers to be board-certified (or strictly board-eligible) in their specialty.

• For MDs: Use the American Board of Medical Specialties (ABMS) CertiFACTS portal.
• For DOs: Use the American Osteopathic Association (AOA) Physician Profile.

Do not rely on a framed certificate from 2018. Board certifications require continuous maintenance of certification (MOC). A provider might have passed their initial boards but lost their certified status in 2025 because they failed to complete their MOC modules. The ABMS portal will show the real-time, current status.

4. Education and Training

For initial credentialing, you must verify the provider's medical school graduation and completion of residencies/fellowships.

Writing letters to individual medical schools is painfully slow and often impossible if a program has closed. Instead, NCQA allows the use of the AMA Physician Masterfile or the AOA Physician Profile as an approved alternative primary source. For foreign medical graduates, you must query the Educational Commission for Foreign Medical Graduates (ECFMG).

5. The National Practitioner Data Bank (NPDB)

The NPDB is a federal repository of medical malpractice payments, adverse clinical privilege actions, and adverse professional society membership actions.

Querying the NPDB is mandatory. By late 2026, many leading health systems and large group practices have abandoned one-off checks in favor of the NPDB Continuous Query service. For a nominal annual fee per provider, Continuous Query proactively alerts your credentialing team within 24 hours if a new malpractice settlement or license suspension is reported against one of your doctors.

6. OIG LEIE and SAM.gov (Exclusions)

You cannot bill Medicare, Medicaid, or TRICARE for services ordered or rendered by an excluded provider. Period.

You must verify the provider against two databases:

1. OIG LEIE: The Office of Inspector General's List of Excluded Individuals/Entities.
2. SAM.gov: The System for Award Management (for federal procurement and debarment).

If you bill Medicare for an excluded provider, the Civil Monetary Penalties (CMP) are massive. You will owe back every dollar paid, plus fines that can exceed $20,000 per claim. Verification against these lists should happen upon hire and every single month thereafter.

Building a Bulletproof PSV Workflow

Credentialing takes time. If you do not track expiration dates aggressively, you will experience sudden cash flow stops when a payer notices a lapsed license before you do.

Your credentialing department should operate on a strict matrix of verification lifespans. NCQA mandates that most verifications must be less than 180 days old at the time the credentialing committee makes its decision. If a state board check is 181 days old when the committee meets, you have to do it again.

Standard Verification Timelines and Sources

Common Red Flags During Verification

Your credentialing specialists should be trained to look for discrepancies during the PSV process. If any of these crop up, the provider needs to supply a written explanation before you submit their file to a payer:

• Unexplained Time Gaps: A six-month gap between residency and their first job. Was the provider in rehab? Were they incarcerated? Did they fail their boards?
• Name Discrepancies: A diploma under a maiden name, a state license under a hyphenated name, and a DEA under a married name. You must collect legal name change documentation (marriage certificates, divorce decrees) to bridge the paper trail.
• Out-of-State DEA Addresses: A provider working in your New York clinic whose DEA is registered to a defunct urgent care in Florida.
• Multiple Malpractice Payouts: Even if a state medical board didn't suspend their license, discovering three major malpractice settlements in the NPDB will likely cause commercial payers like UHC or Anthem to flag the provider for committee review, delaying enrollment by months.

Delegated Credentialing: When Payers Trust Your PSV

If your group practice is large enough, you can enter into a Delegated Credentialing agreement with payers.

Normally, when you hire a doctor, you send their CAQH ProView application to Blue Cross. Blue Cross then performs their own primary source verification, which can take 60 to 120 days. During that time, the provider cannot bill in-network.

In a delegated agreement, the payer audits your credentialing department. If you prove that your PSV policies meet strict NCQA standards, the payer gives you the authority to credential your own doctors. When you hire someone, you do the primary source verification, your internal committee approves them, and you simply send the payer a roster spreadsheet. The provider is effectively in-network the moment your committee says so.

This dramatically accelerates revenue capture for new hires. However, the burden of proof is entirely on your practice. The payer will conduct aggressive annual audits of your credentialing files. If they find that you skipped checking the OIG LEIE, or accepted a photocopy of a DEA certificate instead of querying the DOJ portal, they can strip your delegated status overnight.

CAQH ProView and The Verification Bottleneck

There is a massive misconception among newer practice managers regarding CAQH ProView. Providers spend hours uploading their documents to CAQH, and billing managers assume that because the documents are in CAQH, they are verified.

CAQH is a repository, not a primary source verification entity.

When a provider uploads their medical license to CAQH, they are just uploading a secondary source PDF. When you grant Aetna access to your provider's CAQH profile, Aetna's credentialing team still has to pull that data and perform their own PSV by pinging the state medical board.

To streamline this in 2026, ensure your providers keep their CAQH profiles meticulously updated and re-attested every 120 days. If the state license number in CAQH has a typo, the payer's automated PSV bot will fail to match it against the state board's API, kicking the application out of the automated queue and onto a human's desk. That simple typo just added 45 days to your Medicare enrollment timeline.

Stop trusting paper. Stop trusting PDFs. In medical billing, revenue starts with clean credentialing, and clean credentialing begins and ends with primary source verification.

Frequently asked questions

What is the difference between a primary and secondary source in credentialing?

A primary source is the original entity that issued the credential, such as a state medical board or a medical school. A secondary source is any intermediary, such as a photocopy provided by the physician, a resume, or a hospital's previously completed credentialing file.

Can I use CAQH for primary source verification?

No. CAQH ProView is a data repository where providers store their information and documents. It is not an issuing source. Payers and delegated practices pull data from CAQH, but they must still independently verify that data directly with the state boards, DEA, and ABMS.

How old can a primary source verification be before it expires?

Under NCQA standards, most verifications—including state licenses, DEA registrations, and board certifications—must be no more than 180 days old at the time the credentialing committee reviews and approves the file. Medicare (CMS) has similar timely verification requirements.

What happens if a provider fails an OIG exclusion check?

If a provider appears on the OIG LEIE, they are excluded from participating in any federal healthcare program. You cannot bill Medicare, Medicaid, or TRICARE for their services, nor can they order tests or prescribe drugs for federal patients. Doing so triggers severe Civil Monetary Penalties.

Is the AMA Physician Masterfile considered a primary source?

Yes. While the AMA did not issue the medical degree, NCQA and other accrediting bodies officially recognize the AMA Physician Masterfile and the AOA Physician Profile as acceptable primary source equivalents for verifying medical education and training.