Hiring a physician involves more screening steps than hiring for almost any other role. A hospital or practice is not just confirming that a candidate has no disqualifying criminal history. It is confirming that the person is legally licensed to practice medicine, has not been excluded from federal health care programs, has no history of malpractice payments or disciplinary action that a patient safety committee would need to weigh, and meets the same background check standards that apply to any employment decision under federal law. Each of these checks comes from a different source, follows different rules, and serves a different purpose.
This guide walks through the layers of physician screening: state medical board license verification, National Practitioner Data Bank (NPDB) queries, exclusion screening against the OIG List of Excluded Individuals and Entities (LEIE) and the System for Award Management (SAM), how credentialing differs from a standard Fair Credit Reporting Act (FCRA) background check, fingerprinting, and how hospitals and practices typically sequence all of it during hiring.
Why physician screening has more layers than a typical employment check
Most jobs require one background check from one source. Medicine is different because several separate federal and state systems each track a different kind of risk. A state medical board tracks whether a license is active and whether it has ever been restricted or revoked. The NPDB tracks malpractice payments and certain adverse actions taken by hospitals, boards, and professional societies. The OIG and SAM exclusion lists track people and entities barred from billing federal health care programs. None of these systems talk to each other automatically, and none of them is a substitute for a standard criminal and employment background check obtained through a consumer reporting agency (CRA) under the FCRA. A hospital medical staff office typically runs all of them, often in parallel, before a physician sees a patient.
State medical board license verification
Every state has a medical board (or a board of medicine, board of healing arts, or similar body) that licenses physicians and maintains a public record of license status, board certifications on file, and any disciplinary action. Verifying licensure means confirming the license is active, unrestricted, and was not obtained or renewed on the basis of misrepresented credentials. Most boards publish a public license lookup, and many post formal board orders when a license has been placed on probation, suspended, or revoked. The Medical Board of California’s physician and surgeon licensing pages are one example of how a state board documents its requirements, and other state boards publish equivalent pages that hiring teams should check directly rather than relying on a candidate’s own summary of their license history.
License verification is a form of primary source verification: going to the issuing authority itself rather than accepting a copy of a license or a diploma at face value. Hospitals and credentialing bodies generally treat this step as non negotiable, since an out of date or misrepresented license is a patient safety issue, not just a paperwork gap.
National Practitioner Data Bank (NPDB) queries
The NPDB is a federal repository that collects reports on medical malpractice payments made on behalf of a practitioner, along with certain adverse licensure actions, clinical privilege actions, and professional society actions. Hospitals are generally required to query the NPDB when a physician applies for medical staff appointment or clinical privileges, and again periodically for practitioners already on staff. Health plans, state licensing boards, and other authorized entities can also query it, and physicians can request a self query of their own record.
An NPDB report is not the same thing as a criminal background check, and it does not include criminal history. It is specifically built to give hospitals and boards a record of malpractice history and certain peer review actions that might not otherwise follow a practitioner from one state or institution to another. The NPDB’s guidance on querying explains who is eligible to query, what triggers a mandatory query, and how the process works for health care organizations.
OIG LEIE and SAM exclusion screening
Separate from licensure and malpractice history, federal law bars certain individuals and entities from being paid, directly or indirectly, by federal health care programs such as Medicare and Medicaid. The Department of Health and Human Services Office of Inspector General maintains the List of Excluded Individuals and Entities (LEIE), and the General Services Administration maintains a broader exclusion record inside the System for Award Management (SAM) that covers exclusions from federal contracting and other federal programs. A practice or hospital that employs or contracts with an excluded individual, even unknowingly, can face civil monetary penalties, so exclusion screening is typically run at the time of hire and rechecked on a recurring basis for the life of the employment relationship. The Centers for Medicare and Medicaid Services also maintains provider enrollment requirements that intersect with exclusion status for anyone billing Medicare directly.
Exclusion screening is narrow but consequential. A physician can pass a criminal background check and hold an active license and still appear on an exclusion list because of a prior program integrity finding unrelated to a criminal conviction. That is why exclusion screening is treated as its own step rather than folded into a general background check.
Credentialing vs FCRA background check
Credentialing and an FCRA background check often get discussed as if they are interchangeable, but they are built for different purposes, run by different people, and governed by different rules.
| Element | Hospital or practice credentialing | FCRA background check |
|---|---|---|
| Who runs it | Medical staff office or credentialing committee | A consumer reporting agency, at the employer’s request |
| What it verifies | License status, education, training, board certification, malpractice history, references, NPDB record | Criminal history, employment history, education, and other consumer report items relevant to the job |
| Governing framework | Hospital bylaws, accreditation standards, state licensing law, NPDB reporting rules | The Fair Credit Reporting Act |
| Consent requirements | Application and attestation as part of the credentialing process | Standalone disclosure and written authorization before the report is obtained |
| What happens on an adverse finding | Reviewed by a credentialing committee against medical staff bylaws | Pre-adverse action notice, a copy of the report and a Summary of Rights, then a final adverse action notice if the employer proceeds |
| Typical frequency | Initial appointment, then periodic reappointment (often every two to three years, set by hospital bylaws) | Usually at hire, sometimes rescreened under a written policy |
In practice, most hospitals and larger practices run both. Credentialing answers the question of whether a physician is qualified and in good standing to practice at that facility. An FCRA-compliant background check answers a separate question: what does this person’s criminal, employment, and education record show, obtained the same way it would be for any other employee, with the same disclosure, authorization, and adverse action steps the law requires for every applicant.
Fingerprinting requirements
Whether a physician must be fingerprinted as part of licensure or hiring varies by state and by employer. Some state medical boards require a fingerprint-based criminal history check as a condition of initial licensure, which the state then runs through its own repository and the FBI. California’s medical board, for example, publishes its own fingerprinting requirements for licensees. Other states rely more heavily on name-based checks or only require fingerprinting in specific practice settings, such as facilities that treat vulnerable populations. Because the rule varies this much by state, hospitals and practices generally confirm the current requirement with the state board directly rather than assuming the same process applies everywhere.
A fingerprint-based check and a standard employment background check are not interchangeable either. A fingerprint search is run against law enforcement repositories using biometric identifiers, while most employment background checks obtained through a CRA rely on name and identifier based searches of court and other public records. Employers who want both usually need to request them separately.
Hospital and practice hiring workflow
Most organizations sequence physician screening roughly as follows, though the exact order and ownership can vary by facility size and state:
- Primary source verification of medical school, residency, and any fellowship training, along with current board certification status.
- State medical board license verification, including a check for any current or historical disciplinary action.
- An NPDB query as part of the credentialing application.
- OIG LEIE and SAM exclusion screening, repeated on a recurring basis after hire.
- A standalone disclosure and signed authorization, followed by an FCRA-compliant background check covering criminal history and employment verification, run by a consumer reporting agency.
- Malpractice insurance and claims history verification.
- DEA registration verification for physicians who will prescribe controlled substances.
- Committee review of the full file, followed by a credentialing decision and, separately, any adverse action steps required under the FCRA if the background check portion of the file contains disqualifying information.
Because credentialing and the FCRA background check are legally distinct processes, a practice should not treat a credentialing committee’s decision as a substitute for the pre-adverse action notice, waiting period, and final adverse action notice the FCRA requires when a background check itself is the basis for declining to hire or for taking an adverse employment action.
Screening decisions built around a physician’s license history, NPDB record, or background check results should also account for the Americans with Disabilities Act and related state law where relevant, and hospitals generally involve legal counsel when a finding raises a close call rather than making a unilateral hiring decision.
For related reading on how healthcare credentialing and background screening fit together across roles, see our post on credentialing vs background checks in healthcare, and for a look at how a related clinical role is screened, see our guide to nurse background check requirements.
Frequently asked questions
Is a physician background check the same as credentialing?
No. Credentialing is the hospital or practice’s internal process for verifying a physician’s education, training, license, and history before granting clinical privileges. An FCRA background check is a separate, legally distinct process run by a consumer reporting agency that covers criminal history and other consumer report items, with its own disclosure, authorization, and adverse action requirements.
What does the NPDB show that a criminal background check does not?
The NPDB collects reports on medical malpractice payments and certain adverse licensure, clinical privilege, and professional society actions. It does not contain criminal history, and a criminal background check does not contain NPDB data. Hospitals generally need both to get a full picture.
How often should employers check the OIG exclusion list?
Practices generally screen at the time of hire and then on a recurring basis afterward, since a person can be added to the exclusion list after they are already employed. The exact cadence is a matter of organizational policy, and the primary source for the list itself is the Office of Inspector General.
Do all states require fingerprinting for medical licensure?
The rule varies by state. Some state medical boards require a fingerprint-based criminal history check as part of initial licensure, while others rely more on name-based checks. Employers and applicants should confirm the current requirement with the specific state medical board rather than assuming a single national rule.
Can a hospital deny privileges based on a background check without following FCRA steps?
If the decision is based on information in a consumer report obtained from a background check company, the FCRA generally requires a pre-adverse action notice, a copy of the report, and a Summary of Rights before a final adverse decision, along with a subsequent adverse action notice. Purely internal credentialing decisions not based on a consumer report follow the hospital’s own bylaws instead, so organizations that use both processes typically need separate, clearly defined procedures for each.
Does a clean NPDB report guarantee a physician has no history of misconduct?
No. The NPDB only contains what has been reported to it under federal reporting rules, and not every adverse action or complaint results in a reportable event. A clean NPDB report is one data point among several, alongside license verification, exclusion screening, and a background check, not a complete guarantee on its own.
Reveal Background helps hospitals and practices build a compliant, FCRA-consistent screening process alongside their credentialing workflow.
This article is general information, not legal or medical advice. Employers should consult qualified counsel about how these requirements apply to their organization.
