Written by Donna Thiel, Chief Compliance Officer at ProviderTrust
Twenty years ago, license verification for healthcare providers took place on paper, driven by Xeroxed copies of licenses and phone calls to the boards. Ten years ago, it took place in spreadsheets, with less paper involved but plenty of room for human error due to overly manual tracking and documentation.
Today, many leading hospitals and health systems have ditched those manila files and spreadsheets for automated license verification from market innovators like ProviderTrust. We’ve seen how automation has saved the industry many, many hours of manual work while also protecting patient safety by improving accuracy and timeliness.
But there’s one trend that doesn’t add up: the push for daily license verification as a rule. Over the last several years, more clients and prospects have asked about daily verification. Our answer: Sure, daily license verification is an option, but it’s not usually the wisest or most cost-effective option for an entire licensed population.
The truth is that daily verification just doesn’t move the needle as much as some of our competitors claim. It’s time to retire the idea of daily verification as the answer to the complex problem of license verification, and we’re here to explain why.
- The licensing boards simply aren’t built for millions of daily pass-throughs from all of healthcare.
The 2024 Change Healthcare breach made waves in the healthcare industry, affecting 192,700,000 people in the most egregious healthcare data breach to date. In 2024 alone, there were a total of 736 healthcare breaches—about 2 per day—that affected at least 500 individuals per incident, and the industry is ramping up security protocols accordingly.
The licensing boards are no exception when it comes to increased security measures. Automated primary source verification has been a huge help for healthcare organizations, but the primary sources themselves have no way of determining which high-volume automated inquiries are for license verification purposes and which are nefarious.
For this reason, many of the boards report legitimate automated verification attempts to Amazon Web Services (AWS) as nefarious activity. This makes automated daily license verification very difficult, if not impossible, at a significant number of primary sources.
“Beginning in 2024, we saw a significant change in the security behavior of many licensing boards to protect the sensitive data they maintain. Even though the automation of primary source verification is certainly not a nefarious activity, the security protections cannot differentiate between an acceptable high volume of website activity and a cyber attack.”
- There’s a wide range of licensing bodies, and they all operate differently.
License verification would be much easier if all licensing boards ingested, processed, and reported data the same way. But ProviderTrust works with more than 7,000 license and certification types, and we can tell you that they are all different. Many licensing bodies operate at the state level, which means they’re designed and run according to processes that were created independently.
In some states, automated license verification is made easier by a centralized data hub. For example, the Tennessee Department of Health is a data-rich source that houses all of the state’s health-related licenses in one place. They even post daily bulk files that are available for free download, so that an automated system could perform daily verification without putting technological strain on the board if desired. Still, for most boards, that’s not the case.
Take Arizona, a state that doesn’t have a centralized data hub, as a counter-example. The Arizona State Board of Pharmacy, Arizona State Board of Physical Therapy, and Arizona Board of Occupational Therapy Examiners all have different source URLs with various parameters. License verification at these sources can still be automated, of course, but you risk setting off alarm bells at each source with a large volume of daily verifications.
Once you set off those alarm bells, you won’t be able to access that source again until they determine there’s not an actual security risk—meaning you can’t perform a primary source verification until the board completes their investigation.
- Most licensing boards aren’t updating daily.
The goal of daily license verification is to catch a sanction, board action, or any other licensure issue as soon as it’s flagged at the primary source. But, since all of these license issuers operate independently, there isn’t a standard schedule for updates.
The boards don’t always meet to review issues on a weekly or even monthly schedule. So the vast majority of boards don’t update daily—they update when there’s a change. If the boards were built to accommodate high-volume daily inquiries, daily verifications would make sense as a default to ensure that no change would be missed. But right now, that’s simply not the case.
As one attorney who represents a hospital system bluntly said: “Checking for updates daily is ridiculous.”
- Risk level isn’t uniform, even within a single organization’s population.
Choosing a license verification frequency is all about balancing your risk tolerance with your resource spend. For most healthcare organizations, bill-for-service providers and nurses (RNs, LPNs, and LVNs) pose the highest risk level.
Think about the underlying reason for license verification: When a practitioner comes to work, you want to be sure they’re eligible to work. It makes sense to prioritize more frequent verification—even daily, sometimes—for the populations most likely to have a status change.
To solve this problem, ProviderTrust has a direct integration with Nursys, the primary source equivalent national database for RNs, LPNs, LVNs, and some APRNs. This integration enables us to carry out daily verification for this riskier population without putting additional strain on the boards.
We also prioritize more frequent verifications as the expiration date for any license approaches, even ramping up to daily verification in the last 10 days before expiration to capture the exact renewal date. These standard safeguards allow us to work with each of our clients to determine the right frequency for the rest of their population, since the clear areas of risk have already been considered.
- Weekly verification provides a similar level of risk reduction.
For healthcare organizations with a low risk tolerance, weekly verification provides extra peace of mind without the resource drain of daily verification. And for the boards, weekly verification is an acceptable frequency that doesn’t set off alarm bells security-wise or freeze your ability to access that primary source.
Out of 54,472,786 verifications for ProviderTrust’s top 40 clients, we detected an anomaly, meaning an encumbered status on a license, only 0.00445% of the time. With that in mind, the chance of discovering a licensure issue sooner with daily (vs. weekly or monthly verification) is very, very small.
It’s important to have transparency into your practitioners’ eligibility to work, but it’s equally as important to do so strategically. If your organization’s risk level is especially high, a weekly verification cadence for most of the population and a daily verification cadence for your high-risk population allows you to compromise on frequency without compromising on risk prevention.
Also, keep in mind that the Office of the Inspector General (OIG) and Centers for Medicare and Medicaid Services (CMS) have both said that the standard for liability is “when a reasonable party knew or should have known of the status change.” Since the boards don’t update daily, it would not be reasonable for an organization to know of a change the very day it’s posted.
- Licensure issues take a long time to develop before they actually reach the boards.
The healthcare industry can be quite bureaucratic, and it takes time for a potential issue to be flagged and make its way through a months- or years-long process before it ends up officially attached to a license.
We spoke with a former member of a state licensure board, who was surprised that daily verification has grown in popularity, given that “the process to officially reprimand a physician for an adverse event is lengthy. The state board meets, decides, there’s an appeal process, and finally, the ruling makes its way to the NPDB (National Practitioner Data Bank).”
A licensure issue can only be discovered via automated license verification after completing all these steps. Frequent license verification is crucial to maintaining visibility of your practitioners’ eligibility to provide care. Still, it shouldn’t be the only lever you have to flag a potential issue regarding sanctions, board actions, and other serious encumberments.
- More isn’t always better.
In a world where same-day delivery is the norm, we often assume that the faster (or more frequent) option is naturally better. But when it comes to license verification, quality is just as important as quantity.
If your license verification solution focuses on daily verification instead of data integrity, you might find that you’re not getting accurate results, regardless of what frequency you choose. Instead of fixating on daily verification, ask these questions to make sure you’re getting the most out of your license verification solution:
- Does this vendor verify against the primary source every time?
Some vendors verify against the primary source once, and then check against that initial file “daily” without actually revisiting the primary source for any actual updates for another month.
- How many primary sources does this vendor work with?
ProviderTrust verifies over 7,000 license types and counting.
- Can this vendor offer custom verification frequencies to match my population’s varying risk level?
Instead of defaulting to “daily” verifications across the board, the right partner should be willing to work with you to determine the best strategy for your organization.
Ready to make your license verification solution work smarter, not harder? Get in touch today, and we’ll show you how ProviderTrust can transform your processes.
Reliable Results, Remarkable Efficiency
ProviderTrust’s automated license and credential verifications enable the industry’s most accurate results delivered at exactly the right frequency to prevent eligibility lapses and prioritize patient safety.
Using industry-leading data, we deliver 95% of verifications within 2 days and deploy a dedicated data oversight team to scrutinize any mismatches, at no extra cost. And with automated email alerts, you’ll be aware of any time-sensitive issues right away—without even opening our application.
- Automated primary source verifications
- Includes compact licenses for RNs, LVNs, LPNs
- Up-to-daily email alerts for upcoming expirations
- All healthcare disciplines, all 50 states
- Primary source screenshots and audit-ready reporting