Primary source verification explained

Primary source verification means confirming a specific qualification with the entity that is authoritative for it. Instead of accepting a scanned diploma or a photocopied license, the verifier contacts — or queries an approved database maintained by — the issuing authority and confirms that the credential is genuine, currently valid, and free of restrictions that would matter to the review. This is what separates a credentialing file that merely collects documents from one that proves them, and it sits at the center of the broader work described in what is provider credentialing.

The reason PSV exists is risk. Credentials can be forged, lapse, or carry an action that a self-attestation would not reveal. By going to the source, an organization confirms the qualification as it stands at the moment of the check rather than as it appeared whenever a copy was made. What qualifies as an acceptable primary source — and whether a designated equivalent may stand in — is defined by the standards a health plan or facility follows, and those standards are periodically revised.

The elements subject to primary source verification are drawn from the credentialing file, and the exact list is set by the payer's or facility's policy. The items below are commonly included, but which ones apply — and the acceptable source for each — vary by payer, plan, and state, so the governing standard should always be checked directly.

• State licensure to practice, confirmed with the relevant state licensing board.
• Board certification status, confirmed with the certifying board or an approved verification service.
• Education and postgraduate training, confirmed with the school or program (or an approved equivalent).
• The Drug Enforcement Administration registration where a provider prescribes controlled substances.
• Work history and, where required, hospital affiliations or clinical privileging.
• Sanction, exclusion, and malpractice history checks against the applicable federal and state sources.

Identity anchors such as the National Provider Identifier (NPI) help tie a verified credential to the correct individual, which matters when names are common or a provider has practiced in several states. How these verified elements are assembled and stored is covered in building a credentialing file.

Verification methods differ by source. Some authorities publish real-time databases that a credentialing team can query directly; others respond to a written or electronic request; and for a subset, an accrediting body may accept a designated equivalent source in place of contacting the issuer. The workflow below is a general pattern, not a fixed rule — each payer and accrediting body defines acceptable methods and timeframes.

1. 01

   Identify the required elements

   Determine which credentials the governing payer or facility standard requires to be verified for the provider type and setting.
2. 02

   Locate the approved source for each

   Match each element to the primary source or the approved equivalent the standard allows — a state board, a certifying body, a school, or a recognized verification service.
3. 03

   Query or request the confirmation

   Check the source directly, whether by real-time database query, a formal request, or a response letter, depending on what the source supports.
4. 04

   Record the result and its date

   Capture what was confirmed, the source, and the date of verification, because a confirmation reflects only the moment it was made.
5. 05

   Resolve discrepancies before completion

   If a result conflicts with the file — a lapsed license, a restriction, a name mismatch — the issue is investigated and cleared before the credential is treated as verified.

Primary source verification is often confused with adjacent steps, but it is distinct from each. It is one component of credentialing, which is itself distinct from provider enrollment — the act of joining a specific payer's network or program. The distinction between those two is explored in credentialing vs. enrollment. PSV also differs from privileging, which governs what a provider is authorized to do within a facility; see credentialing vs. privileging.

For Medicare specifically, enrollment runs through the CMS system described in Medicare enrollment with PECOS, using the CMS-855 application family. Verification and enrollment are separate but sequenced activities: a payer generally verifies before it enrolls.

Because a verification reflects only the date it was performed, credentials must be re-verified on a recurring basis. This is why credentialing is never a one-time event. Standards set how often re-verification occurs, and payers and government programs run their own cycles — recredentialing on the commercial side and revalidation on the Medicare side. Those cycles are described in revalidation and recredentialing.

The interval between checks, the elements that must be re-verified, and the acceptable sources are all set by the governing standard and can change, so the current source is the authority. Verification timing also interacts with the effective date a payer assigns, since a network relationship generally cannot begin until verification and the associated review are complete. Planning around these dependencies is the subject of credentialing timelines and planning.