Healthcare Background Screening and Sanctions Guide

• Healthcare background screening combines sanctions searches, criminal record checks, professional license verification, and other role-specific checks to assess a candidate’s eligibility and risk.
• Healthcare sanctions screening identifies exclusions from government health programs. Criminal checks search for criminal records. A clean criminal report does not prove that someone remains eligible to work on federally funded healthcare services.
• Screening must continue after hire because exclusion and license status can change. OIG advises healthcare employers to routinely check new hires and current employees against its exclusion list.
• Screening packages should vary by job duties and jurisdiction. Patient contact, billing access, driving duties, license requirements, and local rules affect which checks apply.

What healthcare background screening covers

Healthcare background screening combines checks selected for a person’s duties, workplace, and jurisdiction. A complete program may review criminal history, healthcare exclusions, professional credentials, identity, employment or education, drug testing, and role-specific registries. No single search answers every eligibility question.

• Healthcare sanctions screening. Sanctions screening asks whether a government program has excluded or restricted a person or entity. The HHS Office of Inspector General maintains the LEIE separately from criminal record repositories. An OIG exclusion can follow a conviction, licensing action, loan default, or program-integrity finding. Employers may also need to search SAM.gov and applicable state Medicaid exclusion lists.
• Criminal background checks. A criminal check asks whether courts or record repositories report criminal history associated with the candidate. Search scope may include county, state, federal, or multijurisdictional sources. A clean criminal report does not establish that someone remains eligible to participate in a healthcare program or holds an active license.
• Professional license verification. License verification asks whether the relevant licensing board confirms a credential’s status, expiration date, restrictions, and disciplinary history. Verification should match the candidate’s profession and each jurisdiction where the person will practice. An active license does not establish that sanctions and criminal searches are clear.

Role duties determine which additional checks belong in the package. A licensed clinician may require license and controlled-substance credential verification, while a driver may require motor vehicle records and applicable drug testing. Positions involving children, older adults, billing, or sensitive health information may call for different sources.

Employers should document what each search covers and what it cannot reveal. Federal requirements, state law, payer contracts, accreditation standards, and internal policy can affect package design, so employers should seek legal guidance for specific screening decisions.

Sanctions screening versus criminal background checks

Sanctions screening and criminal background checks answer different employment questions. Sanctions screening asks whether a person or entity faces an exclusion, debarment, or disciplinary restriction that affects participation in healthcare programs. A criminal check searches court and record repositories for reportable criminal history.

A clean criminal background check does not prove that a candidate remains eligible to work on federally funded healthcare services. The HHS Office of Inspector General can impose permissive exclusions for noncriminal events, including license suspension or surrender, health education loan default, and findings involving excessive charges or substandard services. Those events may never appear in a criminal record repository.

Some conduct can appear in both screening layers, but each source records a different consequence. For example, a healthcare fraud conviction may appear in court records and lead to an OIG exclusion. The court record describes the criminal case, while the exclusion record determines whether federal healthcare programs may pay for items or services furnished, ordered, or prescribed by that person.

Identity matching also requires separate review in each layer. A possible sanctions match may require comparison of names, dates of birth, addresses, and other identifiers. A criminal record requires similar confirmation before you connect it to a candidate. You should route unresolved matches for review rather than treating a name-only result as a final decision.

Professional license verification answers a third question. It confirms whether the appropriate licensing board currently recognizes the credential and whether restrictions or disciplinary actions appear in the primary-source record. An active license does not cancel an exclusion, and a clean sanctions search does not confirm an active license.

OIG exclusions and SAM.gov

Federal healthcare sanctions screening begins with the OIG’s List of Excluded Individuals and Entities, or LEIE. The OIG uses authority under the Social Security Act to exclude people and entities from federally funded healthcare programs. Federal programs generally cannot pay for items or services that an excluded party furnishes, orders, or prescribes.

OIG exclusions fall into two categories.

OIG must impose mandatory exclusions when a qualifying conviction occurs. OIG may impose permissive exclusions for a broader set of conduct, including events that may not produce a criminal conviction. The OIG exclusion authorities provide the applicable grounds and statutory periods.

Hiring or contracting with an excluded party can affect both reimbursement and penalties. OIG states that anyone who hires an individual or entity on the LEIE may face civil monetary penalties. OIG therefore advises healthcare entities to check new hires and current workers routinely.

An expired exclusion period does not automatically restore eligibility. The excluded person or entity must apply for reinstatement, and OIG must grant it. Employers should verify current LEIE status rather than relying on an expected end date.

LEIE and SAM.gov require separate searches because they maintain separate federal exclusion records. A clear LEIE result does not establish that SAM.gov contains no relevant exclusion, and a SAM.gov search does not replace an LEIE check. A federal sanctions workflow should document both searches and retain the identifiers used to resolve possible matches.

State Medicaid exclusion lists

Federal database checks can miss people or entities excluded by a state Medicaid program. A state exclusion does not automatically place the excluded party on the OIG List of Excluded Individuals and Entities or SAM.gov. Employers should identify the state lists that apply based on workforce location, service delivery, Medicaid participation, payer contracts, and other program requirements.

OIG provides a standardized LEIE download and monthly supplement files, while state agencies publish information on different schedules and in different formats. A screening provider or internal compliance function must therefore track relevant sources separately rather than assume that one federal search covers state exclusions.

Your screening population may extend beyond licensed clinicians. Billing staff can affect Medicaid claims, and administrative employees may support federally funded operations. Depending on applicable requirements and job duties, screening may also cover executives, board members, contractors, vendors, volunteers, and trainees. A worker does not need to treat patients directly for an exclusion to affect payment for related services.

Document which federal and state lists apply to each role and location. Your policy should also specify when each source is checked, how potential matches are resolved, and who reviews confirmed exclusions. Legal counsel or compliance specialists can help interpret state-specific obligations and payer contract terms.

Professional license verification

Professional license verification confirms a credential directly with the authority that issued it. A state licensing board serves as the primary source for license status, expiration, and disciplinary history. Candidate-submitted certificates and database results may support the review, but they do not replace the board record. A clean criminal or sanctions check also does not prove that a clinician holds an active license.

Nursys supports nurse verification across participating jurisdictions, including multistate licenses under the Nurse Licensure Compact. You should treat Nursys as a supplement rather than a replacement for checks with the issuing board. State requirements and record formats vary, so verification must account for every jurisdiction in which the person will practice.

The National Practitioner Data Bank provides another source for certain adverse actions, including reportable licensure actions and malpractice payments. However, the NPDB restricts queries to eligible entities such as hospitals, licensing boards, and health plans. Practitioners may request self-queries, but members of the public and unauthorized employers cannot search another person’s records.

Direct board verification can reveal licensure actions before federal exclusion data reflects them. One industry analysis reports an average delay of about 173 days between a state licensure action and its appearance on the OIG exclusion list. Employers that rely on exclusion searches alone may therefore miss a suspended, restricted, or surrendered license for several months. Pre-employment verification and role-based license monitoring help close that timing gap.

Criminal background checks in healthcare settings

Criminal background checks complement healthcare sanctions screening because each search answers a different question. Criminal checks identify reportable conviction and court history, while sanctions searches identify restrictions on participation in government healthcare programs. The OIG maintains its List of Excluded Individuals and Entities separately from criminal record repositories. A candidate can therefore have a clean criminal report and still appear on an exclusion list.

Search scope should reflect the role, work location, and places associated with the candidate. County searches examine relevant local court records, while statewide repositories offer broader coverage where available. Federal court searches cover federal offenses. National criminal databases can help locate possible records, but employers generally need appropriate source-level confirmation before making an employment decision.

Lookback periods and restrictions on using criminal history vary by jurisdiction and may also depend on the position. You should define screening rules by role and location rather than applying one package across the workforce. Legal counsel can help assess local requirements and job-related criteria without turning every reported record into an automatic disqualification.

Healthcare roles may require registry searches beyond standard criminal records. Elder-abuse registries may apply to positions serving older adults, while child-abuse registries may apply to pediatric or youth-facing work. Patient access, driving duties, controlled-substance access, and work in home-care settings can also affect the appropriate search package. A documented role matrix helps you apply these additions consistently.

Drug testing considerations by role and jurisdiction

Healthcare employers should set drug testing rules by job duties and work location rather than apply one policy across the workforce. Patient care responsibilities may support different testing decisions than office duties, while transportation regulations can create mandatory requirements for certain driving roles.

Federal transportation rules require alcohol and drug testing for covered safety-sensitive positions. A medical courier, fleet driver, or ambulance employee falls under those rules only when the position meets the applicable DOT definition. For covered employees, marijuana remains prohibited even when state law permits medical or recreational use. Federal guidance also distinguishes safety-sensitive industry requirements from general workplace testing.

General pre-employment testing depends more heavily on state and local law. New York, Philadelphia, and Nevada illustrate how cannabis rules can restrict testing or an employer’s response to a positive result, though some laws contain exceptions for defined safety-sensitive positions. Federal contractor status does not automatically settle the question. The Drug-Free Workplace Act requires certain contractors and grantees to maintain drug-free workplace policies, but the statute itself does not require drug testing.

Cannabis testing also has a clinical limitation. THC can remain detectable for days or weeks, and a positive result does not reliably establish current impairment. Some jurisdictions therefore limit adverse action based only on a positive pre-employment result.

You can manage these differences with a role and location matrix that identifies covered DOT positions and applicable cannabis restrictions. Counsel should review current state law, local rules, facility requirements, and contract terms before you adopt or revise a policy. Employers may also treat pre-employment, reasonable-suspicion, and post-accident testing as separate policy decisions.

Role-based screening packages

You should assign screening packages according to job duties, work location, and applicable rules. Patient contact, government-program billing, driving, credential requirements, and access to controlled substances create different screening needs.

A written package rule should connect every search to a specific duty or requirement. For example, a motor vehicle record serves little purpose for a desk-based scheduler, but it directly addresses risk for an employee who transports patients. Primary-source license verification applies when a position requires an active professional license, while abuse registry searches may apply when a worker serves children, older adults, or other vulnerable people.

Exclusion screening requires broader analysis than job title alone. The OIG advises healthcare entities to check the LEIE routinely for new hires and current employees because hiring an excluded person may create civil monetary penalty exposure. OIG guidance supports screening workers whose services, orders, prescriptions, or supporting duties connect to federally funded healthcare.

You should configure each package by role and work location, then document why each component applies. State law, payer rules, contracts, accreditation requirements, and internal policy may change the final package. Legal counsel should review the matrix before you use it for employment decisions.

Recurring monitoring after hire

Pre-hire screening captures a candidate’s status at one point in time. An employee can later receive an exclusion, lose a license, or appear on a state Medicaid list, so recurring monitoring closes the period between hiring and the next scheduled review.

Monthly LEIE checks follow the list’s monthly update cycle. OIG advises healthcare entities to routinely check current employees and new hires because federal healthcare programs cannot pay for items or services furnished, ordered, or prescribed by an excluded party. OIG’s explicit monthly mandate applies to state Medicaid enrollment screening, not directly to every private employer. Your organization should set its cadence based on applicable contracts, program rules, state requirements, and legal guidance.

License monitoring should track status, disciplinary actions, expiration dates, and renewals through the issuing authority. A reminder before expiration gives the employee time to renew, while a follow-up check confirms that the board completed the renewal. Separate board monitoring can identify an action before it reaches an exclusion database. One industry source reports an average lag of roughly 173 days between state licensure action and appearance on the OIG exclusion list.

Monitoring scope should follow each role’s duties. Licensed clinicians generally require license and sanctions monitoring. Billing staff, executives, contractors, and others connected to federally funded claims may require federal and relevant state exclusion checks even when they do not treat patients. Driving records or other specialized sources apply only when job duties create the corresponding risk.

Continuous monitoring can send alerts when a connected source reports a new record, reducing gaps between scheduled searches. Source update schedules still limit alert speed, especially for state lists and licensing boards. Your program should document which sources cover each role, how often each source refreshes, who reviews possible matches, and how reviewers resolve identity before taking action.

Candidate consent and adverse action under FCRA

The following sequence offers general information, not legal advice. State and local requirements may add notices, waiting periods, or limits, so legal counsel should review your policy for each hiring location.

1. Provide disclosure and obtain authorization. Before ordering a report from a consumer reporting agency, give the candidate a clear, stand-alone disclosure and obtain written authorization. Avoid burying the disclosure inside the employment application or unrelated acknowledgments.
2. Review results against job-related criteria. Verify that flagged records belong to the candidate, and consider whether each record affects the duties of the specific role. EEOC guidance and some state laws may call for an individualized assessment that considers the nature of the conduct, the time elapsed, and its relevance to the position.
3. Send a pre-adverse action notice. Before rejecting the candidate based partly or entirely on the report, provide a copy of the report and the federal Summary of Rights. Give the candidate a reasonable period to review the information and respond before finalizing the decision.
4. Pause the decision during a dispute. A candidate may challenge inaccurate or incomplete information through the screening provider, also called the consumer reporting agency. Consumer reporting agencies generally must investigate disputes within 30 days, with an extension to 45 days in some circumstances. You should review any corrected report before continuing the adverse action sequence. The VICTIG dispute guide explains these notice and reinvestigation steps.
5. Send the final adverse action notice. If the decision remains unchanged after the response period and any dispute, notify the candidate of the final action. Include the screening provider’s name, address, and phone number. State that the provider did not make the hiring decision and cannot explain it. The notice should also explain the candidate’s right to dispute the report and request another free copy within 60 days.

Automated pass or fail rules can bypass identity checks, individualized review, and required notices. Your ATS can route flagged reports for review, but a qualified person should document the job-related reasoning before any adverse decision.

Building the workflow in your ATS

1. Map each job before ordering a report. Record the work location, required credentials, patient contact, access to protected data, billing responsibilities, driving duties, and work with controlled substances. Package rules can then assign checks based on the role and jurisdiction instead of applying one package to every candidate.
2. Capture consent and transfer candidate data securely. The ATS should collect the required disclosure and written authorization before sending necessary candidate information through an access-controlled provider integration. Direct transfer reduces duplicate data entry and limits avoidable handling of sensitive information.
3. Track every screening component separately. Standardized status labels should show whether each criminal search, sanctions search, license verification, or drug test remains pending, has cleared, or requires review. A single overall status can hide a delayed county search or an unresolved exclusion match.
4. Route exceptions to a designated reviewer. The ATS should send possible sanctions matches, identity discrepancies, license issues, and criminal records into a documented review queue. Reviewers should confirm source records and resolve identity details before making an employment decision. Automated pass or fail rules should not convert an unverified database match into a rejection.
5. Document decisions before adverse action. The workflow should record who reviewed the result, which policy applied, what evidence supported the decision, and when each notice was sent. When a consumer report may influence an adverse decision, employers should follow the federal process described in the FTC’s employer guidance and account for applicable state and local requirements.

Role-based permissions should limit access to people who need screening information. Audit trails should preserve package selection, status changes, reviewer activity, notices, and candidate disputes. Clear ownership rules should identify who handles each exception and who can approve the final decision. These controls make the ATS or HRIS record usable during internal reviews, candidate disputes, and compliance audits.

Evaluating a healthcare screening provider

A provider comparison should test data coverage, record handling, workflow support, and service performance. Ask each provider the same questions and require written answers that identify sources, refresh schedules, and responsibilities.

• Which federal and state sources does each sanctions search cover, including the OIG exclusion list, SAM.gov, and applicable state Medicaid exclusion lists?
• Which sources come directly from an issuing authority, and which rely on aggregated databases?
• How does the provider resolve potential matches when records contain similar names, incomplete identifiers, or conflicting information?
• Does professional license verification use the issuing board as the primary source? What details does the report capture about status, expiration, restrictions, and disciplinary action?
• How often does each monitoring source refresh? How quickly does the provider verify an alert before sending it to you?
• Can you assign packages by role and work location within your ATS or HRIS?
• Can recruiters track each search separately and identify delays without contacting support?
• What audit records document consent, report delivery, exception review, and adverse action notices?
• What tools support pre-adverse notices, candidate disputes, reinvestigation, and final notices? Your legal counsel should confirm whether the workflow fits applicable federal, state, and local requirements.
• How does the provider report turnaround time for individual search components rather than as one blended average?
• Who handles recruiter and candidate questions, and what response time does the provider commit to in writing?
• What implementation, security, uptime, and escalation commitments appear in the contract?

VICTIG fits buyers who value responsive, U.S.-based support and integration options. The company reports a 1.8-day average turnaround time and a seven-minute average email response time, and it offers ATS integrations and a background check API. Buyers should confirm how those capabilities apply to their selected healthcare searches, jurisdictions, and monitoring requirements during a product demonstration and contract review.

Comparing screening providers

VICTIG and Checkr both serve healthcare employers, but their verified positioning differs in service model and technology.

VICTIG may fit employers that prioritize published turnaround and support-response benchmarks, direct assistance, and flexible integration options. Its verified company information supports those points. Buyers should still ask both providers to demonstrate sanctions sources, professional license verification methods, recurring monitoring, and role-based package configuration before choosing a vendor.

FAQs

What is the difference between healthcare sanctions screening and a criminal background check?

Healthcare sanctions screening searches exclusion and disciplinary sources tied to participation in healthcare programs. A criminal background check searches court records for criminal cases, so the two checks answer different eligibility questions.

What do OIG and SAM.gov exclusions mean?

An OIG exclusion can prevent federal healthcare programs from paying for items or services furnished, ordered, or prescribed by an excluded party. OIG maintains the LEIE, while SAM.gov maintains a separate federal exclusion database that requires its own search.

How often should healthcare employers re-screen workers?

Healthcare employers should check applicable exclusion lists before hire and repeat searches after employment begins, often monthly where program requirements or risk policies call for that schedule. License checks should also follow expiration dates, renewal cycles, role requirements, and relevant state rules.

Does a clean criminal background check mean a clinician is eligible to work?

No. A clinician can have no reportable criminal record but still appear on an exclusion list, hold an expired or restricted license, or have a disciplinary action that affects the role.

What does pre-adverse action require?

Before making a negative employment decision based on a consumer report, an employer generally provides the candidate with the report, a summary of FCRA rights, and a reasonable opportunity to respond. Employers should address disputes before sending a final adverse action notice and should confirm the exact federal, state, and local requirements that apply.

Does professional license verification satisfy sanctions screening requirements?

No. Professional license verification confirms license status with the issuing authority, while sanctions screening searches exclusion and disciplinary sources. A person may hold an active license while remaining subject to a healthcare program exclusion or another sanction.

Building a defensible screening program

Defensible healthcare screening depends on combining sources that answer different questions. A criminal search cannot confirm license status or reveal every healthcare exclusion. Sanctions searches and professional license verification fill those separate gaps, while recurring checks can identify changes after hire.

Review each package against the employee’s duties and work location. Confirm that the package reflects patient contact, billing access, driving responsibilities, and jurisdiction-specific requirements. Then document why each check applies and when you will repeat it. Legal counsel can help assess requirements for each jurisdiction.