Compliance officers ask this question often, usually right before a new hire’s start date or right after an audit finding shows up. The short answer is that HIPAA does not contain a line that says “you must run a criminal background check.” But that misses the part that actually matters for a covered entity: the HIPAA Security Rule requires you to control who has access to electronic protected health information, and background screening is the standard way most organizations satisfy that duty. Skipping it does not violate a specific sentence in the statute. It does, however, leave a gap in your safeguards that an auditor or the Office for Civil Rights will notice.
This piece walks through what the rule text at 45 CFR 164.308 says, what “addressable” actually means, who counts as workforce, and which other laws, not HIPAA, actually force a background check in healthcare settings.
The direct answer
No, HIPAA does not explicitly require criminal background checks on every employee. What it requires is broader and, in some ways, harder to satisfy with a checkbox: covered entities and business associates must implement policies and procedures to ensure that all members of the workforce have appropriate access to electronic protected health information (ePHI), and must prevent those who should not have access from getting it.
That requirement lives in the Security Rule’s administrative safeguards, specifically the workforce security standard at 45 CFR 164.308(a)(3). One of its implementation specifications is a “workforce clearance procedure,” meaning a process to determine that a workforce member’s access to ePHI is appropriate. The regulation does not name background checks as the method. It leaves the method to you, which is exactly why so many compliance officers assume the requirement does not exist at all.
What 45 CFR 164.308 actually says
Section 164.308 covers the administrative safeguards portion of the Security Rule. Three parts of it are relevant to hiring and screening decisions:
- 164.308(a)(3)(i), Workforce Security: covered entities must implement policies and procedures to ensure that all members of the workforce have appropriate access to ePHI, and to prevent those workforce members who do not need access from obtaining it.
- 164.308(a)(3)(ii)(B), Workforce Clearance Procedure: an addressable implementation specification requiring a procedure to determine that a workforce member’s access to ePHI is appropriate.
- 164.308(a)(1)(ii)(C), Sanction Policy: a required (not addressable) specification. You must apply appropriate sanctions against workforce members who fail to comply with your security policies and procedures.
You can read the full current text of the section, including the authorization and supervision and termination procedure specifications that sit alongside workforce clearance, at the Cornell Law School’s Legal Information Institute copy of 45 CFR 164.308.
What “addressable” actually means
This is the part that trips up new compliance officers the most. “Addressable” does not mean optional. It means the covered entity must assess whether the specification is a reasonable and appropriate safeguard for its environment, and then do one of three things:
- Implement the specification as written.
- Implement an equivalent alternative measure that accomplishes the same purpose.
- Document, in writing, why neither option is reasonable and appropriate given the entity’s risk analysis, and show what compensating control fills the gap.
What is not on that list is “ignore it.” A covered entity that skips a workforce clearance procedure and has no documentation explaining why is not in a defensible position. In practice, almost no organization can credibly argue that verifying a new hire’s identity, employment history, and criminal record before granting them access to patient records is unreasonable. That is why background screening has become the de facto standard for satisfying this specification, even though the word “background check” appears nowhere in the regulation.
Who counts as “workforce” under the rule
The Security Rule’s definition of workforce is intentionally broad. It includes employees, volunteers, trainees, and other persons whose conduct, in the performance of work for the covered entity, is under the direct control of that entity, whether or not they are paid. That reaches:
- Full-time and part-time employees
- Per diem and contract clinical staff
- Interns, residents, and students on rotation
- Volunteers with any access to patient areas or records
- Temporary staff placed through a staffing agency
It does not, by itself, reach business associates, but that does not mean business associates are outside the scope of concern. A business associate that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is directly subject to the applicable Security Rule administrative safeguards, including its own workforce security obligations for its own staff. A hospital that contracts with a medical billing company, a transcription service, or an IT vendor should expect that vendor’s workforce clearance practices to come up in due diligence and in the business associate agreement.
What actually does mandate background checks in healthcare
This is where the real teeth are, and it is worth being precise about it because HIPAA gets blamed (or credited) for requirements that come from entirely different sources.
| Requirement | What it covers | Does it mandate a background check? |
|---|---|---|
| HIPAA Security Rule, 45 CFR 164.308(a)(3) | Workforce access to ePHI | No, but requires a clearance procedure; screening is the standard way to satisfy it |
| State professional licensing boards | Nurses, physicians, pharmacists, and other licensed roles | Yes, in most states, as a condition of initial licensure and renewal |
| CMS Conditions of Participation | Hospitals, skilled nursing facilities, home health agencies, and other Medicare and Medicaid certified providers | Often yes, depending on the setting and state survey requirements tied to certification |
| State caregiver and long term care laws | Nursing homes, assisted living, home care aides working with vulnerable adults | Yes, most states require fingerprint based criminal history checks for direct care staff |
| OIG exclusion screening duty | Anyone paid, directly or indirectly, with federal health care program funds | Effectively yes, ongoing checks against exclusion lists are expected, separate from a one time criminal check |
State licensing statutes are usually the most direct source of a hard background check requirement. Most state boards of nursing, medicine, and pharmacy require an applicant to disclose and clear a criminal history review before a license issues, and many require periodic re-verification. The federal Conditions of Participation that CMS enforces on Medicare and Medicaid certified providers add another layer, particularly for long term care and home health settings, where state survey agencies often require fingerprint based checks as part of certification compliance. You can see how CMS structures its certification and survey oversight on the CMS quality, safety, and oversight page.
Separately, and often overlooked, every healthcare employer that receives any federal health care program funding has an affirmative duty to check the OIG List of Excluded Individuals and Entities (LEIE) before hiring, and on a recurring basis afterward, for every employee, contractor, and vendor. This is not the same thing as a criminal background check. An individual can pass a criminal record check and still appear on the exclusion list for reasons like healthcare fraud, patient abuse findings, or licensure revocation. Details on how the exclusion authority works are on the HHS Office of Inspector General’s exclusions program page, and the specific mandatory and permissive exclusion categories are laid out on OIG’s exclusion authorities page. Our own guide to OIG, LEIE, and SAM exclusion screening covers how to build a recurring monthly check into a compliance calendar so this does not become a once and done step.
The sanction policy piece nobody mentions
Section 164.308(a)(1)(ii)(C) requires a sanction policy against workforce members who violate security policies, and this is a required specification, not addressable. It matters for background screening in a specific way: if your workforce clearance procedure and your sanction policy are not connected, an auditor will ask why. If a background check surfaces a disqualifying finding after hire, or a workforce member is later excluded from federal health care programs, your sanction policy needs to define what happens next, up to and including termination of access and employment. A clearance procedure without a sanction policy behind it is half a safeguard.
Building a practical screening package for a HIPAA covered employer
Given all of the above, most compliance officers land on a similar package. A reasonable baseline for a healthcare employer, before granting access to ePHI, typically includes:
- Identity verification, including Social Security number trace
- County and statewide criminal record search covering all jurisdictions of residence for the past seven to ten years
- National criminal database search as a supplement, never a replacement, for county level checks
- Sex offender registry search
- OIG LEIE and SAM exclusion list search, run at hire and monthly thereafter
- State licensing board verification for any clinical or licensed role
- Employment and education verification appropriate to the role
Our guide on criminal background checks for healthcare workers goes deeper into how to scope each of these by role, since a billing coordinator with no patient contact and a home health aide with unsupervised access to a patient’s residence carry very different risk profiles even though both may touch ePHI. Working with a professional background check provider that understands FCRA adverse action rules and healthcare screening needs keeps the process consistent and defensible across every hire.
Documenting your workforce clearance procedure for an audit
If OCR ever asks to see how you satisfy the workforce security standard, the answer “we run background checks” is not sufficient on its own. What holds up in an audit is a paper trail showing:
- A written policy describing your workforce clearance procedure and what triggers it (new hire, role change, contractor onboarding)
- Your risk analysis reasoning for why background screening, specifically, is the reasonable and appropriate method you chose under the addressable standard
- Records showing the procedure was actually followed for a sample of recent hires, not just that a policy exists
- A sanction policy that ties back to clearance findings and post-hire exclusion or licensure issues
- Evidence of recurring exclusion list monitoring, not a single check at hire
Auditors look for the gap between what a policy says and what actually happened. A folder of signed authorization forms with no documented decision process is weaker evidence than a shorter policy that is consistently followed and documented.
Frequently asked questions
Does HIPAA require a criminal background check for every employee?
No. HIPAA requires a workforce clearance procedure to determine that access to ePHI is appropriate, under the addressable specification at 45 CFR 164.308(a)(3)(ii)(B). It does not name a specific screening method, but a background check is the most common and defensible way organizations satisfy this requirement.
What does “addressable” mean in the HIPAA Security Rule?
Addressable means the covered entity must assess the specification and either implement it, implement an equivalent alternative, or document why neither is reasonable given its risk analysis. It does not mean optional.
Do HIPAA business associates need to run background checks on their staff?
Business associates are directly subject to the applicable Security Rule administrative safeguards for their own workforce, including workforce security obligations. Covered entities also commonly require background screening standards in business associate agreements as a matter of due diligence, separate from HIPAA’s direct requirements.
What actually forces healthcare employers to run background checks?
State professional licensing requirements, CMS Conditions of Participation for certified providers, state caregiver and long term care statutes, and the OIG’s exclusion screening duty are the sources that create direct, mandatory screening obligations. HIPAA supports and reinforces the practice but is not the primary legal source of the mandate in most cases.
Is checking the OIG exclusion list the same as a background check?
No. A criminal background check searches court and record databases for convictions and charges. OIG exclusion screening checks a separate federal list of individuals and entities barred from participating in federal health care programs, and it must be repeated regularly, not just at hire.
What happens if a HIPAA covered entity skips background screening entirely?
Skipping screening does not automatically violate a specific HIPAA sentence, but it leaves the workforce clearance specification unaddressed. Without documentation showing why an alternative safeguard is reasonable, that gap is difficult to defend in an OCR audit or after a breach involving an unscreened workforce member.
This article is general information for compliance planning purposes and is not legal advice. Consult qualified legal counsel to evaluate your organization’s specific HIPAA compliance obligations.
