Primary source verification, explained without the vendor gloss.

Primary source verification means confirming a credential with the entity that issued it, rather than accepting a copy of the document from the person who holds it. A diploma photocopy is not verification of a degree; a response from the school is. A license card is not verification of licensure; a response from the licensing board is.

The reasoning is not that providers lie — the overwhelming majority do not. It is that a copy carries no assurance about the credential's current state. A genuine license card says nothing about whether that license was suspended last month.

Where it is required

For health centers, credentialing and privileging requirements are stated in the Health Center Program Compliance Manual's clinical staffing chapter, and assessed through the corresponding Site Visit Protocol chapter — which treats procedures for review of credentials and procedures for review of privileges as separate elements. HRSA also publishes examples of the documentation it expects to see, which is a more useful starting point than most vendor material.

Requirements also differ by category of staff: licensed independent practitioners, other licensed or certified practitioners, and other clinical staff are not treated identically. A one-size credentialing checklist applied to everyone is usually doing too much for some people and too little for others.

Which sources can actually be queried directly

This is where marketing and reality diverge, so it is worth being concrete. A small number of sources expose a real-time, machine-queryable interface:

• NPPES (the CMS NPI registry) — queryable, individually and in bulk.
• State or territorial licensing boards — varies enormously. In Puerto Rico, ORCPS publishes an online license verification that returns the professional's name, specialty, license number, municipality, issue date, expiration date and status.
• OIG LEIE and SAM.gov — for exclusions, which is a related but separate obligation.

Most of the rest — board certification, malpractice history, education, training, work history, references — is verified through a request and a response, by a person, on a timescale of days to weeks. That is normal and it is not a deficiency. What is a deficiency is a system that displays a manually confirmed item in the same visual language as an automated query, because it removes the one signal that told the reader to look closer.

The four states, and why the fourth carries the risk

Any verification attempt lands in one of four states, and collapsing them is the most common structural error in credentialing records:

• Verified — the source answered and the answer matches the file. Store the response, not a checkbox saying someone looked.
• Discrepancy — the source answered and it does not match. Keep both values visible; the person resolving it needs to see what differs.
• Expired — the credential itself has lapsed. Nothing is wrong with the verification.
• Unable to verify — the source did not answer, timed out, or returned nothing. This is not a pass.

Everything expensive happens in the fourth state. A registry that was down, a portal in maintenance, a name that returns no result — these are unresolved attempts. A file that records them as verified looks complete right up until someone asks for the evidence behind the verification, and then it is worse than an obviously incomplete file, because it was relied upon.

Three habits that survive a review

• Store the response, not the conclusion. A screenshot or saved record of what the source returned answers the question a reviewer asks; a checkbox does not.
• Date everything, including failures. An unresolved attempt from March, still unresolved in October, is a finding — but only if March was recorded.
• Re-verify what expires. Verification is a statement about a moment. Licenses expire on schedule; exclusion status can change at any time, which is why exclusion screening runs on a cycle rather than once at hire.