Medical staff credentialing — primary-source verification of sanctions and exclusions

Template version 2026-10-06 · for: Hospital Medical Staff Offices, CVOs, health-plan credentialing committees · owner role: Director, Medical Staff Services (owner); Credentials Committee (decision); Compliance Officer (oversight) · adopted by organization effective date . Editable .txt · JSON

Template. Written against the public text of the standard cited; the organization adopts, edits and owns it as its protocol. Every threshold, identity, hold or disclosure decision belongs to the organization. We report the findings against the protocol — counts, dates, states — nothing more. Not legal advice, not a compliance determination, not a consumer report.

Standards served

42 CFR 482.22 — Conditions of Participation: medical staff; credentialing and privileging — https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/section-482.22
The Joint Commission MS.06.01.03 / MS.06.01.05 — primary source verification; reappointment at least every 2 years (verify current edition) — https://www.jointcommission.org/
NCQA Credentialing standards CR 1 / CR 3 — sanctions verified from an acceptable source within the time frame; recredentialing within 36 months — https://www.ncqa.org/programs/health-plans/credentialing/
HHS-OIG LEIE — the primary source for federal program exclusion — https://oig.hhs.gov/exclusions/

Scope

Every applicant for appointment or reappointment, every privileged practitioner and allied health professional, and telemedicine practitioners credentialed by proxy.

Frequency

At initial appointment and reappointment, within the time frame the accreditor sets before the committee decision; monthly between cycles under HOSP-01.

Procedure

Collect the identifiers that make a match exact: NPI, state license number(s), DEA number where applicable, DOB. A name alone yields candidates, not a verification.
Within the accreditor's window before the Credentials Committee date: one dated read of OIG LEIE and the state Medicaid exclusion list(s) by NPI and exact name; SAM.gov exclusions; state licensing board action records for each license held; DEA registrant actions where published. The record must show the source, the source's own date and the date verified.
File the record in the credentials file as the primary-source verification of sanctions. The record is a read of the source itself, not a report about the source — note that for the surveyor.
Any row printed under the practitioner's exact name or NPI goes to the Medical Staff Director for identity confirmation against the agency record, then to the Committee with the identity decision documented.
A source that did not answer is re-read before the Committee date; if it cannot be, the file states which source was not verified and the Committee decides under its bylaws.
Between cycles, the practitioner stays on the monthly roster (HOSP-01). Reappointment restarts this procedure.

Findings reported — computed from your own records; the threshold is your protocol's

Finding	Computed as	Data source	Threshold
Verification within window	files whose sanctions read is dated inside the accreditor's pre-decision window ÷ files decided	credentials file dates; receipt created_at	your protocol
Exact-key verification rate	files verified by NPI (and license number) rather than name only ÷ files	receipt identity block	your protocol
Reappointment timeliness	practitioners reappointed within 24 months (TJC) / recredentialed within 36 months (NCQA) ÷ due	MSO database	your protocol
Source completeness at decision	files with every sanctions source answered on the decision date ÷ files	receipt did_not_answer	your protocol
Survey producibility	minutes to produce the dated sanctions verification for a surveyor-selected file	HOSP-08 drill	your protocol

Records

Record	Kept by	Retention
Credentials file with dated sanctions read (source, source date, verify date, hash)	MSO	per medical staff bylaws and HOSP-08
Identity decisions on candidate rows	Medical Staff Director	with the file

What this procedure does not decide

Appointment, privileges, identity of same-name rows, and any adverse action — those are the Credentials Committee's and the Board's under the bylaws and due-process rules.

Change log

Date	Change
2026-10-06	First issue.
date	adopted / edited by name

Other templates: 01 · 02 · 05 · 06 · 07 · 08 · 09 · 10 · 01 · Duty Sheets (one page per rule, generated on any receipt) · our own procedures · 2026-10-25