Credentialing Specialist's NPI Checklist: Primary Source Verification Step by Step

What an NPI Does and Does Not Prove

Understanding the limits of the NPI prevents the single most common credentialing shortcut: treating a valid NPI lookup as a proxy for full primary source verification. An NPI confirms one thing: a provider applied for and was issued a unique 10-digit identifier under HIPAA. CMS verifies only two things at the time of NPI issuance: that the Social Security number is valid and that the submitted business address exists. It does not verify licensure, specialty, whether the provider works at that address, or anything about the provider's eligibility to bill Medicare.^[3]

The NPI is also "intelligence-free" by design. Nothing encoded in the number indicates the provider's state, specialty, license status, or enrollment history. It remains permanently associated with a specific individual regardless of practice changes, state moves, or additional specialty training. This permanence is a feature for HIPAA transaction processing; for credentialing purposes it means stale NPI records are common and the number alone tells you very little about the provider's current status.

NPPES vs. PECOS: Two Separate Systems Credentialing Must Check

The most consequential gap in credentialing workflows is treating NPPES and PECOS as equivalent or redundant. They are entirely separate databases with different purposes, different data, and different verification rigor.

NPPES issues NPIs and stores public provider information for HIPAA transaction routing. Enrollment is self-service, most data is self-reported, and there is no scheduled re-verification. Providers can have an active NPI indefinitely without updating their record or participating in any payer network.

PECOS is the Medicare enrollment system. Enrollment requires active submission of supporting documentation, license verification against state medical board websites, OIG exclusion screening, and MAC review. PECOS records must be revalidated every three to five years depending on provider type and risk level. Providers must report changes in ownership, practice location, and adverse legal actions within 30 days or risk suspension of billing privileges.^[1]

The two systems do not automatically sync. A provider can update their address in NPPES without it carrying to PECOS, and vice versa. Discrepancies between the two now trigger compliance reviews under 2026 CMS enforcement policy and can result in payment suspension. For credentialing specialists, this means both must be checked independently and any mismatch is itself a red flag requiring resolution before the application can proceed.^[2]

Primary Source Verification: All Five Sources

NCQA credentialing standards, updated in July 2025, define primary source verification as confirmation obtained directly from the issuing authority for each credential element. For NPI-related credentialing, five sources each answer a distinct question that none of the others can answer alone.

Some organizations also verify the DEA registration number for prescribing providers through the DEA Diversion Control Division at deadiversion.usdoj.gov. This is not yet a universal PSV requirement but is standard practice for controlled substance prescribers and is included in the PECOS enrollment checklist for providers who hold a DEA number.^[4]

NPI Credentialing Checklist

The following checklist covers the NPI-related verification steps for an individual provider (Type 1 NPI). For organizations and groups, add a parallel checklist for the Type 2 NPI covering the entity's legal name, EIN, authorized official designation, and PECOS enrollment status as an organization.

1. Confirm the NPI is Type 1 (individual) and is active.

   Search NPPES or NPI Profile by the provider's legal name and confirm the entity type is Type 1, the status is active, and the NPI number matches what the provider submitted on the application. A deactivated NPI stops the process. A Type 2 NPI submitted as an individual's identifier is a disqualifying error.

2. Verify the name in NPPES matches the application exactly.

   Compare the legal name in NPPES against the name on the credentialing application. Discrepancies, including maiden name vs. married name, hyphenated surnames, and middle name vs. middle initial, must be resolved before submitting to payers. Payers cross-reference the NPPES name against the application and will reject or delay an application if they do not match.

3. Check that the practice address in NPPES matches the credentialing application.

   The business practice location address in NPPES must match the address being submitted for credentialing. If the provider recently changed practices and has not updated NPPES, the mismatch will cause a hold. The provider must update NPPES before the credentialing application is submitted, not after. Updates to NPPES take effect on the next NPI Profile refresh cycle and may take additional time to propagate to payer systems.

4. Confirm the taxonomy code and that it matches the service the provider will credential for.

   The primary taxonomy code in NPPES must correspond to the specialty under which the provider is credentialing. Verify the code at NPI Profile's taxonomy lookup or the NUCC taxonomy list at taxonomy.nucc.org. If the provider has multiple taxonomy codes, confirm that the correct one is designated as primary. A mismatch between the credentialing specialty and the NPPES taxonomy can delay or deny payer applications.

5. Cross-reference the license number in NPPES against the state licensing board.

   NPPES displays the license number and state the provider self-reported at enrollment. Verify this number against the actual state board database to confirm it is active, unrestricted, and carries the same expiration date as shown in the credentialing application. A license number in NPPES that no longer exists at the state board, or that shows a different expiration, is a hard stop requiring resolution.

6. Check PECOS enrollment status for Medicare-participating providers.

   Use NPI Profile's PECOS lookup or the CMS Medicare Fee-for-Service Public Provider Enrollment file at data.cms.gov to confirm the provider is enrolled in PECOS and is in the ordering and referring file if applicable. A provider who has an active NPI but is not in PECOS cannot bill Medicare or order items for Medicare patients. Confirm enrollment status before the credentialing application is submitted to any Medicare Advantage or Medicaid managed care plan that requires PECOS enrollment.

7. Screen against the OIG LEIE and SAM.gov at initial credentialing.

   Search exclusions.oig.hhs.gov and sam.gov using the provider's legal name, NPI, and Social Security number or EIN where available. A match on either list means the provider is excluded from federal health care programs and cannot be credentialed for Medicare, Medicaid, or any federally funded program. Document the search date and result. Any match must be escalated to the credentialing committee before the application continues.

8. Query the NPDB for malpractice payments and adverse actions.

   NPDB queries are required at initial credentialing and at least every two years at re-credentialing for NCQA-accredited organizations. The query returns malpractice payment history, hospital privilege revocations, DEA certificate surrenders, and Medicare and Medicaid exclusion actions. NPDB access requires registration at npdb.hrsa.gov. Results must be reviewed by the credentialing committee and retained in the provider file.

9. Verify CAQH ProView data matches NPPES and the application.

   Most payers use CAQH ProView as a universal credentialing hub. The NPI, taxonomy, address, and license information in the CAQH profile must match NPPES exactly. Inconsistencies between the CAQH profile and NPPES are among the most common reasons payers delay or reject credentialing applications. Confirm CAQH attestation is current (not expired) before any new application is submitted.

Red Flags That Should Pause a Credentialing Application

The following conditions found during NPI-related primary source verification require resolution before an application proceeds. None of these are automatic disqualifiers, but each represents a discrepancy that payers will catch and that will cause a delay or denial if submitted unresolved.

PECOS Enrollment Document Checklist

When a provider must enroll in PECOS as part of the credentialing process, the following information is required. This checklist is drawn directly from the official CMS PECOS enrollment checklist for sole proprietors and solely owned organizations.^[4]

Taxonomy Mismatches and How They Affect Credentialing

Taxonomy codes are the credentialing dimension of the NPI record that cause the most invisible delays. A taxonomy code is a 10-character code from the NUCC Health Care Provider Taxonomy standard that describes a provider's classification and specialization. Every NPI record must have at least one primary taxonomy, and that code is visible in the public NPPES registry.

The problem arises from three system interactions:

First, NPPES and PECOS use different taxonomy systems. Most NPPES taxonomy codes map to a PECOS specialty code, but some NPPES codes map to more than one PECOS category, and some PECOS specialty categories have no corresponding NPPES code. A provider whose NPPES taxonomy maps ambiguously to PECOS may have specialty discrepancies between the two systems without either record being wrong on its own terms.^[3]

Second, a wrong taxonomy code in PECOS can cause Medicare claim denials. CMS uses the specialty information in PECOS to determine whether a provider is eligible to bill for a given service type. If PECOS lists the wrong specialty for the service being billed, the claim is denied. Because PECOS revalidation occurs on a 3 to 5 year cycle, a wrong taxonomy can silently cause denials for years before the issue surfaces in credentialing.

Third, payers cross-reference the taxonomy in NPPES against the specialty under which a provider is applying. If a behavioral health therapist's primary taxonomy in NPPES is listed as a general counselor code rather than the specific LCSW or LPC code the payer network requires, the application will return for correction. Updating NPPES taxonomy is done through the NPPES portal and requires logging in with the provider's I&A credentials.

Ongoing Monitoring: OIG, NCQA, and Revalidation

Initial credentialing is not a one-time clearance. Credential status changes after the initial application. Licenses expire or become restricted, providers acquire adverse actions, and OIG exclusions can be imposed at any point during a provider's career. A credentialing program that only screens at initial enrollment and re-credentialing cycles has gaps that represent both compliance risk and payment liability.

OIG LEIE and SAM.gov: monthly screening

The OIG LEIE is updated monthly. The OIG's position, supported by its 2013 Special Advisory and CMS guidance to state Medicaid programs, is that screening must be performed upon hire and monthly thereafter. Medicare Part C and Part D plans are explicitly required to run monthly checks. NCQA updated its standards in July 2025 to require monthly exclusion monitoring for all credentialed providers, escalated to a peer-review body when issues are found.^[5]

Monthly screening should cover the OIG LEIE, SAM.gov, and applicable state Medicaid exclusion lists. At least 44 states maintain their own exclusion databases, and a provider may appear on a state list before a federal OIG exclusion is imposed. The civil monetary penalty for billing for services furnished by an excluded individual is up to $25,595 per item or service as of January 2026, plus treble damages.^[5]

NCQA primary source verification timelines

As of July 2025, NCQA reduced its primary source verification window from 180 days to 120 days for organizations seeking Credentialing Accreditation and to 90 days for Credential Verification Organizations (CVOs) seeking Certification. Verification data that falls outside these windows is considered expired and must be recollected before the credentialing file can be submitted for committee approval.^[5]

PECOS revalidation

CMS requires Medicare-enrolled providers to revalidate in PECOS every five years for most individual practitioners and every three years for high-risk provider types. Trigger events that can require earlier revalidation include changes in ownership or Tax Identification Number, new practice locations, adverse legal actions, and significant malpractice settlements. Providers who miss their revalidation deadline face payment suspension. CMS sends revalidation notices by mail to the address on file in PECOS, which is another reason keeping PECOS updated separately from NPPES matters operationally.^[1]

Frequently Asked Questions