NPI Verification and Provider Credentialing Checklist

Why Provider Credentialing Requires Multiple Databases

No single database contains all the information needed to fully credential a healthcare provider. The NPPES NPI registry confirms identity and federal enrollment. State medical boards track licensure and disciplinary history. The DEA Diversion Control Division tracks prescribing authority. CMS PECOS tracks Medicare enrollment. The OIG LEIE tracks federal exclusions. The NPDB tracks malpractice and adverse actions. The ABMS and AOA track board certifications. A thorough credentialing process pulls from all of these sources — beginning with NPI verification as the identity anchor and proceeding through each database systematically.

Step 1: NPI Verification via NPPES

Start every credentialing workflow with NPI verification in NPPES. Search by the provider's name and state using this tool or at npiregistry.cms.hhs.gov. Confirm: the provider's legal name matches their submitted credentials exactly; the NPI is active (not deactivated or suspended); the primary taxonomy code matches the specialty they are being credentialed for; the primary practice address is current and matches other submitted documents; any state license numbers listed in NPPES are consistent with the license verification you will conduct next. Document the NPI, enumeration date, and taxonomy codes. If there are discrepancies between the NPPES record and submitted credentialing documents, request clarification from the provider before proceeding.

Step 2: State Medical License Verification

Verify the provider's state medical or professional license directly with the issuing state licensing board — do not rely solely on the provider's attestation or NPPES data. Each state's medical board maintains an online license verification portal. Confirm: license is active and in good standing, license number matches what the provider provided, license type matches the provider's credentials (MD, DO, NP, PA, etc.), there are no disciplinary actions, restrictions, or probations, expiration date is current or within renewal period, and the provider is authorized to practice in the state(s) where they will be providing services. For providers credentialed for telehealth, verify licenses in all states where they will see patients.

Step 3: DEA Registration Verification

For providers who will prescribe controlled substances, verify DEA registration status with the DEA Diversion Control Division at deadiversion.usdoj.gov. Confirm: DEA registration is active (not expired, suspended, or revoked), DEA registration number is valid (verify the mathematical checksum), registrant name and address match the provider's current information, DEA schedules authorized match the provider's clinical needs, and registration expiration date — set a reminder for renewal 90 days before expiration. Note that a DEA number that fails the mathematical checksum validation is a significant red flag requiring immediate investigation. Providers without controlled substance prescribing needs do not require DEA verification.

Step 4: Medicare PECOS Enrollment Check

For providers who will bill Medicare (directly or through a facility), verify Medicare enrollment status in the CMS PECOS system at pecos.cms.hhs.gov. Confirm: provider is enrolled in Medicare, enrollment status is active (not opted out, excluded, or pending), the PECOS enrollment NPI matches the NPPES NPI, the enrolled specialty matches the provider's credentials, and no Medicare payment suspensions are active. Providers with a PECOS enrollment status of 'Opt-Out' have formally elected not to participate in Medicare and patients cannot submit Medicare claims for their services except in emergency situations. For facility billing, ensure the rendering provider's NPI is linked to your facility's group enrollment.

Step 5: OIG LEIE Exclusion Check

The Office of Inspector General (OIG) maintains the List of Excluded Individuals and Entities (LEIE) — a federal database of providers excluded from participation in Medicare, Medicaid, and all federal healthcare programs. Search the LEIE at oig.hhs.gov/exclusions. Any provider, employee, or contractor found on this list cannot be employed or contracted by any entity receiving federal healthcare program reimbursement — employing an excluded individual triggers significant financial penalties. The LEIE check must be performed for all providers, not just physicians. Also search the SAM.gov federal exclusions database for additional debarments. Run LEIE checks at initial credentialing and monthly thereafter for all active providers.

Step 6: NPDB Query for Malpractice and Adverse Actions

The National Practitioner Data Bank (NPDB) at npdb.hrsa.gov contains reports of medical malpractice payments, adverse licensure actions, clinical privilege actions, DEA actions, and Medicare/Medicaid exclusions. Healthcare organizations credentialing physicians and dentists are required by law to query the NPDB during initial credentialing and every two years for recredentialing. An NPDB query requires registration and a per-query fee. NPDB reports do not prevent credentialing by themselves — they are data points that must be evaluated in context. A single resolved malpractice payment from years ago is different from a pattern of recent adverse actions. Credentialing committees should have a documented policy for evaluating NPDB reports.

Step 7: Board Certification Verification

For physicians, verify board certification status directly with the issuing board — not from the provider's CV. The American Board of Medical Specialties (ABMS) maintains a public verification tool at certificationmatters.org for its 24 member boards. The American Osteopathic Association (AOA) provides verification for DO board certifications. For other providers: nursing certifications through ANCC, pharmacy through NABP, physical therapy through FSBPT. Verify: certification is current (most boards require maintenance of certification activities), specialty matches credentialed privileges, and no reports of certification revocation. Note that many specialty boards require ongoing maintenance activities — an expired certification can occur even in actively practicing physicians.

Step 8: Malpractice Insurance Verification

Request a current Certificate of Insurance (COI) directly from the provider's malpractice insurance carrier — not from the provider. The COI should confirm: coverage type (occurrence vs. claims-made), policy limits meet your organization's minimums (commonly $1M/$3M for physicians), the provider's name and specialty are listed as insured, policy dates include the proposed start date, and your organization is listed as a certificate holder. For claims-made policies, verify tail coverage arrangements for prior coverage periods. Providers employed by hospitals may be covered under the hospital's institutional policy — confirm this explicitly. Insurance coverage gaps, particularly for high-risk specialties, are credentialing red flags requiring explanation.

Frequently Asked Questions