Healthcare Staffing Compliance Checklist Licenses, Credentials, and Background Checks

A genuine healthcare staffing compliance program isn’t simply 1 background check followed by a start date on a calendar. It’s a full sequence of separate, legally required steps, license verification, credentialing, exclusion screening, background checks, each carrying its own standard, its own timing requirement and its own distinct documentation trail, and skipping or compressing any single 1 of these steps creates real, tangible regulatory exposure rather than just a minor administrative gap somewhere in a file. When a shift genuinely needs to be filled at 6 a.m. and a qualified candidate happens to be available, the pressure to shortcut this entire process is real and immediate, but the penalties for getting any of this wrong, Civil Monetary Penalties from the OIG, Joint Commission accreditation risk, FCRA class action liability, are every bit as real and every bit as costly.

This checklist walks carefully through what a genuinely defensible healthcare staffing compliance program actually needs to cover: how license and credential verification actually has to work in practice, what background and exclusion screening legally requires of both parties, who’s genuinely responsible when an agency places a worker at a client facility, and how to sequence all of it without grinding an otherwise urgent hiring process to a complete halt. None of this is legal advice for a specific situation, and any staffing organization building or auditing its own compliance program should be working directly with qualified legal counsel familiar with healthcare regulatory requirements in its specific operating states, since those requirements can vary meaningfully, and sometimes substantially, from 1 jurisdiction to the next.

TL;DR

• Primary source verification is the standard, not a candidate’s word. The Joint Commission and CMS both require confirming a license directly with the issuing board, and a photocopy, a candidate’s self-attestation, or a staffing agency’s own credential packet doesn’t satisfy that standard on its own, no matter how complete or official it happens to look sitting on paper.
• Exclusion screening has to happen before placement and then monthly for the life of the engagement. The OIG updates its List of Excluded Individuals and Entities monthly, and there’s no urgency exception, an excluded worker can’t be paid with federal healthcare program funds for services performed, regardless of how quickly a shift genuinely needed to be filled that day.
• The facility’s compliance duty doesn’t disappear just because a staffing agency did its own screening. Both the agency and the client facility carry independent, non-delegable obligations to verify licensure and exclusion status, which means documentation has to be built carefully to satisfy both parties involved in it, rather than only 1 side of the overall placement arrangement entirely.

Why a Formal Checklist Matters in Healthcare Staffing

Healthcare staffing carries an entire additional layer of regulatory obligation that most other kinds of staffing simply don’t ever carry, because the workers being placed are performing real clinical services reimbursed directly by federal healthcare programs, and the consequences of placing an unqualified or ineligible worker extend well beyond what would otherwise just be a single bad hiring decision made in haste. An improperly credentialed clinician can trigger real, formal licensing board action against the facility that made the placement, a worker who later turns out to already be on the OIG’s exclusion list can create direct, serious Civil Monetary Penalty exposure for both the staffing agency and the client facility involved, and a background check run without proper FCRA disclosure can expose the agency to genuine class action liability, regardless of how urgently that specific role needed to be filled at the time.

A written checklist exists specifically to make sure none of these legally required steps get quietly skipped under real-world hiring pressure, and to create the documentation trail that proves, clearly and after the fact, that they genuinely didn’t. That documentation matters every bit as much as the underlying check itself does, since “the license was on file” and “the license was verified through the issuing board” are 2 very different claims, and only 1 of those 2 claims actually satisfies what Joint Commission and CMS genuinely expect to see during an audit. A structured healthcare staffing process that records the date, method and result for every single check performed is what turns a compliance program from a well-meaning intention into something that actually holds up under real, sustained regulatory scrutiny when it genuinely matters most.

The Healthcare Staffing Compliance Checklist at a Glance

Each single row in this table represents a genuinely separate legal requirement carrying its own distinct, independent standard of proof, which is exactly why a healthcare staffing compliance program can never be reduced to a single background check vendor’s report alone. A broader healthcare staffing solution still needs separate processes for licenses, credentials, background screening and documentation rather than treating candidate vetting as 1 consolidated check. The sections that follow go through each category in considerably more detail, starting with licenses, moving through credentials and background checks in turn, and finishing with the harder questions of who’s actually responsible and how to sequence everything without slowing an urgent hiring process to a complete crawl.

License Verification Requirements

Primary Source Verification Is the Actual Standard Confirming a license directly with the issuing licensing board, rather than accepting a candidate’s photocopy, self-attestation, or even a staffing agency’s own credential packet, is genuinely what the Joint Commission and CMS both require as the actual standard. The Joint Commission defines primary source verification as confirmation that an individual possesses the required valid license, certification or registration to practice a profession. A checklist item for license verification needs to specify exactly which verification method was actually used and record the resulting finding in full, since a file that only shows “license on file” doesn’t actually demonstrate that primary source verification happened the specific way regulators genuinely expect it to occur.

Multistate Compact Licenses Need Their Own Check Where a clinician holds a license issued under a multistate compact, such as the Nurse Licensure Compact, confirming the placement state’s current compact status is a genuinely separate step from simply confirming the underlying license itself. The official Nurse Licensure Compact guidance explains that a multistate license authorizes practice across participating NLC jurisdictions, while practice in a noncompact state requires separate licensure. A compact license issued in 1 particular state doesn’t automatically extend its privileges into a different state that hasn’t yet joined the compact, or that has technically joined but hasn’t fully implemented it in practice, which means a license that looks valid on paper can still be the wrong credential for a specific placement location.

Renewal Timing Creates a Real Operational Risk A clinician cleared for placement based on a license that’s set to renew within just a few days creates a genuine, real gap if that specific renewal confirmation gets delayed, or if a board action happens to get issued during that exact narrow window of time. Staffing agencies that verify credentials only once, at the initial point of hire, rather than actively monitoring status through the full length of an assignment, create real blind spots that let a lapsed license, a new restriction, or a board action go completely unnoticed while a clinician continues working an active assignment regardless.

Credentialing Requirements

• Board certifications need the same primary source treatment as licenses. A board certification claimed on a resume needs confirmation directly through the certifying body, since the standard that applies to licensure, direct verification rather than self-attestation, applies with equal force to board certifications and any other formal credentials a candidate happens to claim they currently hold on their resume.
• Specialty certifications like ACLS, BLS and PALS need expiration tracking well beyond a single check. These credentials carry specific renewal cycles, and a certification that was valid at the point of hire can expire partway through an assignment if nobody is actively tracking the renewal date, a gap that a 1-time credentialing check performed only at hire will never catch on its own.
• Client-specific credentialing requirements often exceed the baseline. Hospitals, health systems and health plans frequently layer their own additional credentialing standards on top of what regulators require, and healthcare administrative staffing across multiple client facilities needs a system that tracks each facility’s specific requirements rather than applying 1 generic standard uniformly across every single placement the agency ever makes.
• Credential and document expiration tracking is an ongoing responsibility, not a 1-time task. Certifications, registrations, licenses and even insurance policies all carry their own expiration timelines, and managing those timelines actively throughout an assignment, rather than only at the point of initial hire, is what separates a credentialing program that holds up from 1 that quietly accumulates gaps over time.

Background Check Components

Criminal History Checks Follow the Most Conservative Applicable Standard State rules governing criminal history reporting vary quite significantly by jurisdiction across the country, and when a candidate’s history spans multiple states, background check providers and employers should apply whichever applicable standard is most conservative rather than defaulting to the rule of the state where the placement happens to occur. This matters specifically for multi-state staffing operations, where a clinician’s criminal history check might need to satisfy several different state standards simultaneously depending on where they’ve lived and worked.

FCRA Disclosure and Authorization Come Before the Check, Not After Written disclosure and authorization under the Fair Credit Reporting Act are legally required before any background check gets ordered, regardless of how urgently a position needs to be filled, and this requirement fully covers temporary, per-diem and agency-placed workers right alongside direct hires. The FTC’s employment background check guidance specifically requires written notice and permission before an employer obtains covered background information from a reporting company. Skipping or rushing this step to save time exposes the agency to FCRA class action liability, which is exactly the kind of risk that urgency-driven hiring decisions tend to create without anyone fully realizing it in the moment.

I-9 and E-Verify Obligations Belong to the Employer of Record A staffing agency serving as the legal employer of record carries its own fully independent Form I-9 and E-Verify obligation, separate from whatever the client facility’s own process looks like, and that obligation can’t be skipped just because a client requests it or assumes the agency has already handled it. Confirming which party is legally the employer of record for a specific placement, and confirming that party has actually completed its I-9 and E-Verify obligations, is a step that’s easy to assume away and genuinely risky to get wrong.

Drug Screening Requirements Vary by Client and State Pre-placement drug screening requirements genuinely differ by each client facility and by state, and a staffing agency working across multiple clients needs a system that applies the correct panel and standard for each specific placement rather than a single default policy applied uniformly everywhere. A formal permanent healthcare staffing process commonly includes credential verification and background screening as separate parts of candidate vetting, which helps prevent those client-specific requirements from being treated as an afterthought. Getting this wrong in either direction, screening too narrowly for a client’s actual requirement or applying an unnecessarily broad panel where it isn’t required, creates its own set of problems worth avoiding through a system that tracks client-specific requirements accurately.

Exclusion and Sanctions Screening: The Non-Negotiable Step

Exclusion screening against the OIG’s List of Excluded Individuals and Entities, commonly known simply as the LEIE, stands out as the 1 compliance step with the least room for any flexibility anywhere in this entire checklist. Federal law creates real, direct exposure to Civil Monetary Penalty liability for employing or placing an excluded individual, and the OIG’s LEIE guidance states that healthcare entities should routinely check new hires and current employees while the exclusion information itself is updated monthly. The LEIE currently contains well over 70,000 individuals and entities barred entirely from receiving federal healthcare program payments, and the OIG updates that specific list on a regular monthly basis, which is exactly why a single pre-hire check isn’t sufficient on its own.

The screening obligation itself extends well beyond the federal LEIE alone, reaching several other sources a compliant program has to cover. Employers also need to check the GSA’s System for Award Management and whatever state Medicaid exclusion list applies, since many individual states maintain their own independent exclusion lists that don’t simply mirror the federal database, and a genuine multi-state staffing operation needs to screen carefully against every applicable state list, rather than simply assuming that federal-level screening alone covers the full picture across every jurisdiction. The screening obligation also extends beyond licensed clinical staff to cover contractors, vendors and, in many organizations’ conservative interpretation of the requirement, volunteers whose work connects in any way to federally reimbursed claims.

The real-world consequences of getting this specific requirement wrong are well documented and genuinely significant for any organization involved. In 1 2025 enforcement action, a group of skilled nursing facilities agreed to pay more than $1.5 million for employing individuals who were excluded from federal healthcare programs, a concrete illustration of exactly the financial exposure this screening requirement is meant to prevent. Most healthcare organizations have now adopted monthly rechecking of the LEIE and applicable state lists specifically to align with this recurring monthly update cycle and to meaningfully reduce their own Civil Monetary Penalty risk, since waiting for an annual review cycle creates a genuine window where a status change could go undetected for months.

Who’s Responsible: Agency vs Facility

This table reflects a specific point that’s genuinely worth underscoring clearly: a facility can’t simply take a staffing agency’s word that screening actually happened, since both organizations independently carry their own non-delegable duties under the relevant federal healthcare program rules. When organizations work with a staffing agency, the division of screening, onboarding and compliance responsibilities still needs to be documented rather than assumed. Relying on a vendor’s assurance without a contractual commitment and independent verification of its own is widely considered an inadequate compliance control, which is exactly why staffing contracts should address exclusion screening and licensure verification obligations explicitly in writing, rather than leaving that division of responsibility implied, assumed, or left entirely to chance.

Recordkeeping and Documentation Requirements

• Background check records need to be retained for at least 1 year. This particular baseline comes from EEOC recordkeeping rules covering records tied to any hiring decision, which includes background check results regardless of whether that particular hiring decision ultimately turned out positive or negative for the specific candidate who happened to be involved in that particular hiring process from start to finish.
• Form I-9 carries its own, longer retention rule. Form I-9 records need to be kept for 3 full years after the date of hire or 1 year after termination, whichever of those 2 dates happens to be later, and USCIS guidance on Form I-9 retention confirms that employers must use whichever period is longer after employment ends.
• Every check needs a recorded date, method and result, well beyond a simple pass or fail notation. A completed checklist is only as defensible as its documentation, and a record that simply shows “cleared” without capturing when the check happened and how it was performed doesn’t hold up the same way a fully documented record does if that record is ever reviewed during an audit or an investigation.
• When a screening match occurs, documentation of the response matters as much as the original check. If exclusion screening or a background check turns up a match, the employer’s documented response, when it was discovered, what action was taken, when legal counsel was notified, becomes its own critical piece of the compliance record, since regulators evaluate both whether a problem existed and how quickly and appropriately it was addressed once discovered.

Timing: Sequencing Checks Without Slowing Down Hiring

Most of the compliance checks covered throughout this post have no actual dependency on each other at all, which means they can genuinely run in parallel starting from the moment of a verbal offer, rather than strictly one after another in a rigid sequence. License verification, credential confirmation, exclusion screening and the background check itself can all be initiated at essentially the same time once a candidate has formally accepted an offer and provided whatever necessary authorizations each step requires, compressing the total time to an actual placement considerably, without ever skipping or shortcutting a single required step anywhere along the way.

What genuinely can’t be compressed, however, is the order of legal prerequisites built into the process itself. FCRA disclosure and written authorization have to happen genuinely before a background check gets ordered, rather than in parallel alongside it, and OIG exclusion screening has to be fully complete before a worker actually provides any billable service at all, rather than merely initiated around the same general timeframe. VALiNTRY’s own candidate hiring process places background checks and drug testing within the new-hire stage after mutual vetting has concluded, illustrating why onboarding steps still need an explicit sequence. Understanding which specific steps are genuinely sequential, because some legal requirement demands 1 particular thing happen before another, versus which steps simply feel sequential purely out of established habit, is exactly what lets a staffing organization move quickly without accidentally skipping a step that regulators treat as mandatory, regardless of how quickly that specific role needed to be filled in the moment.

Common Compliance Gaps That Create Real Risk

• Treating license and credential verification as a 1-time event at hire. Licenses lapse, board actions get issued and credentials expire throughout the length of an assignment, and a compliance program that only checks status once at the point of hire creates exactly the kind of blind spot that lets a clinician keep working an active assignment after their qualifications have changed.
• Assuming the client facility’s own screening covers the agency’s obligation, or the reverse. Since both the staffing agency and the client facility carry independent, non-delegable duties to verify exclusion status and licensure, quality staffing screening processes still need clearly assigned responsibilities rather than assuming the other party has already handled every check. Assuming the other party has already handled it is a documented gap waiting to surface during an audit, rather than a reasonable division of labor either side can safely rely on.
• Running exclusion screening once at hire instead of monthly throughout the engagement. Given that the OIG updates the LEIE on a monthly basis, a pre-hire-only screening approach leaves an assignment exposed for the entire remaining length of the engagement, since a worker’s status can change to excluded at any point after that initial check without anyone noticing until the next screening cycle actually runs.
• Keeping incomplete documentation that shows results without showing method. A record that simply notes a license or background check as “cleared,” without capturing the date, the specific verification method used and who performed it, doesn’t meet the documentation standard regulators actually expect, which becomes a real problem only when that gap gets discovered during an audit rather than caught and corrected beforehand.

How FACIS and Similar Screening Platforms Fit Into the Process

Many healthcare staffing organizations now run their exclusion and sanctions screening through specialized platforms built specifically for this purpose, rather than manually checking the federal LEIE database by hand for every single candidate that comes through. The Fraud Abuse Control Information System, commonly known as FACIS and offered through vendors like Verisys, aggregates data across thousands of primary sources at its deepest available tier, including the OIG LEIE, the GSA’s System for Award Management, individual state Medicaid exclusion lists, licensing board actions and broader federal agency sanctions, all searchable through a single platform rather than requiring separate manual checks against each individual database.

Using a specialized screening platform doesn’t eliminate the underlying compliance obligation, it simply makes fulfilling that obligation more efficient and considerably more consistent across a large candidate volume. An organization placing dozens or even hundreds of clinicians across multiple states genuinely can’t rely on manually checking each individual database by hand every single month without a meaningful risk of human error creeping into the process somewhere along the way. Staffing firms already using technology-supported candidate screening follow the same basic principle: technology can organize and document checks, but it doesn’t remove responsibility for verifying the underlying information. What a platform like this actually does provide is a documented, timestamped record of exactly which specific sources were checked and precisely when, which directly supports the kind of detailed documentation trail this entire checklist has emphasized throughout as the real standard regulators actually expect to see in practice.

Choosing a screening platform still requires real, genuine due diligence of its own before signing on, since not every vendor covers the same depth of sources or the same breadth of state-level exclusion lists a specific staffing operation might genuinely need to satisfy its own obligations. An organization evaluating screening platforms should confirm exactly which sources a given tier of service actually covers, how frequently the underlying data gets refreshed, and whether the platform’s own reporting meets the specific documentation standard the organization needs to satisfy both its own internal compliance requirements and whatever its client facilities separately expect to see as proof of screening.

Building the Checklist Into Daily Operations Rather Than a One-Time Audit Prep Document

A compliance checklist that only gets pulled out before an accreditation survey or a client audit isn’t actually functioning as a compliance program, it’s functioning as documentation theater that happens to look reassuring right up until a real gap surfaces at the worst possible moment. The checklist items covered throughout this post, license verification, credentialing, exclusion screening, background checks, recordkeeping, only deliver genuine protection when they’re built into the actual daily workflow of placing and managing healthcare workers, not treated as a separate compliance exercise layered awkwardly on top of the real work of staffing.

Practically, this means assigning clear ownership for each recurring check, monthly exclusion screening, credential expiration tracking, license renewal monitoring, to a specific person or team with a defined process for what happens when a check surfaces a problem. Healthcare organizations working across markets with different state requirements, including employers using healthcare staffing in Indianapolis, still need those state and client differences incorporated directly into routine workflows. It also means building the documentation habit directly into the workflow itself, recording the date, method and result at the moment each check actually happens, rather than trying to reconstruct that record after the fact when an audit request arrives and memories of exactly what was checked, and when, have already started to fade considerably.

Organizations that treat this checklist as a living operational tool, revisited and refined as regulations change and as the organization’s own placement volume grows, tend to catch problems while they’re still small and easy to correct. Organizations using structured healthcare staffing and screening still need to keep those controls active after the initial placement rather than treating compliance as complete once onboarding ends. Organizations that treat it as a static document finished once and filed away tend to discover its gaps the hard way, during an actual audit, an enforcement action, or a client relationship damaged by a compliance failure that a properly maintained checklist would have caught months earlier before it ever became a genuine problem worth worrying about.

FAQs

What does primary source verification actually mean for a healthcare license?
It means confirming the license directly with the issuing licensing board itself, rather than accepting a candidate’s photocopy, self-attestation, or even a staffing agency’s own credential packet as sufficient standalone proof. This is the specific standard that the Joint Commission and CMS both require, and a checklist item should record which verification method was used along with the result.

How often does OIG exclusion screening need to happen?
Screening needs to happen before placement in every case, and then at least monthly for the entire remaining length of the engagement, since the OIG updates its List of Excluded Individuals and Entities on a monthly basis. There’s no urgency exception under Civil Monetary Penalty authority that allows an employer to skip or delay this check, regardless of how quickly a role needed to be filled.

Can a staffing agency rely on a client facility’s background check instead of running its own separate check?
Generally no, it can’t, since both the staffing agency and the client facility each carry their own independent, non-delegable obligations to verify licensure and exclusion status under the relevant federal healthcare program rules. Relying entirely on the other party’s screening without a contractual commitment and independent verification of its own is widely considered an inadequate compliance control, regardless of which side of the placement is doing the relying.

What happens if a staffing agency places a worker who later turns out to be on the OIG exclusion list?
The agency, and potentially the client facility too depending on the specific facts of the arrangement, can face real Civil Monetary Penalty liability, since federal law creates this specific exposure regardless of intent on anyone’s part. A documented 2025 enforcement action saw a group of skilled nursing facilities pay more than $1.5 million for employing individuals who were already excluded from federal healthcare programs at the time.

Does FCRA actually apply to temporary and per-diem healthcare workers, or does it only cover permanent hires?
FCRA disclosure and written authorization requirements fully apply to temporary, per-diem and agency-placed workers right alongside permanent direct hires. This means a background check for even a short-term, per-diem assignment requires the exact same written disclosure and authorization process before the check is ever ordered, just as a background check for a permanent position would require in full.

How long do healthcare staffing compliance records actually need to be kept on file? Background check records generally need to be retained for at least 1 full year under EEOC recordkeeping rules that cover any hiring-related decision made. Form I-9 carries its own distinct retention requirement of 3 full years after the date of hire or 1 year after termination, whichever of those 2 specific dates happens to come later in a given case.

What’s the actual difference between a license and a credential in this specific context?
A license is the formal legal authorization to practice, issued and closely regulated by a state licensing board directly, while a credential typically refers to additional certifications, such as board certifications or specialty training like ACLS or BLS, that demonstrate specific competencies beyond the baseline license itself. Both require primary source verification, but they’re tracked and renewed on different timelines through different issuing organizations.

Why do multistate compact licenses need their own separate verification step?
A license issued under a multistate compact, such as the Nurse Licensure Compact, only genuinely extends practice privileges into states that have actually joined and fully implemented that specific compact already, which means a compact license that looks perfectly valid on its face might still turn out to be the wrong credential entirely for a placement in a state that hasn’t joined the compact at all. Confirming the placement state’s current compact status is a distinct check from confirming the underlying license itself.