The Healthcare Staffing Background Check: What It Covers, and What Happens to the Record Afterward

Criminal background search, completed February 12, 2026. One line in a placement file, with a date beside it.

The line is accurate. On that day, a county search and a national search returned what the records held. A healthcare staffing background check reads records as they stood on one morning, which is what it is built to do.

Most of an agency's exposure sits in what happens to that line afterward. The obligations attached to the placement keep running once the search closes, on clocks the search never touched.

What a healthcare staffing background check actually reaches

The industry standard behind it comes from NAMSS, the National Association Medical Staff Services, in its Ideal Credentialing Standards for initial-practitioner applicants.

Criterion 8 reads: "An applicant's background check includes conducting a County Criminal Search and National Criminal Search to check the applicant's criminal activity within the past seven years, at minimum." It asks for a county search in every county the applicant has lived and worked in. The same criterion says these checks "should occur during initial credentialing and can be done ad-hoc at any time".

NAMSS states these as best practice, with no regulatory force. NAMSS also writes staffing agencies into the definition of who performs credentialing, listing "telemedicine, ambulatory, staffing or locum tenens companies" alongside hospitals and health plans.

The seven-year window gets misread in both directions, and it comes from the Fair Credit Reporting Act. The limit at 15 U.S.C. 1681c(a) governs arrests, civil suits, civil judgments and other adverse items, and it expressly excludes "records of convictions of crimes". Convictions carry no federal time limit. The limit binds what a consumer reporting agency may report and does not cap what an employer may consider. Section 1681c(b)(3) lifts those limits only for a consumer credit report used in employment at an annual salary expected to reach $75,000 or more.

Accreditation ties the background check to the applicant and sets no re-check interval

Nothing in the accreditation standards tells a hospital, or the agency supplying it, to run the search a second time. Joint Commission National Performance Goal NPG.12.04.01 came into force on January 1, 2026. Element of performance 1 reads: "The hospital obtains a criminal background check on the applicant as required by law and regulation or hospital policy. Criminal background checks are documented."

The operative word is applicant. The standard binds the criminal check to the person at the point of application.

Federal law does not fill the gap. The surveyor process for 42 CFR 482.13 says a hospital conducts criminal background checks "as allowed by state law for all potential new hires". Screening obligations in US healthcare come from state statute and from contract.

For an agency, the contract is where the client's policy arrives. In practice, this means a healthcare staffing background check has whatever shelf life the staffing agreement gives it, and most give it none. Settle that point before the check set for a new client is signed off.

One month of exclusion actions, published in the middle of the next month

Screen a candidate today and you are reading a list that closed weeks ago. That is how the list is built.

OIG says "health care entities should routinely check the list to ensure that new hires and current employees are not on it". Its exclusions FAQ gives the cadence: "Both versions of the LEIE are generally updated by the middle of each month. The updates include all actions taken during the prior month."

On August 23, 2026, OIG's download page carried a last update of August 10, and the newest full database file was labeled 07-2026. An agency screening that day against the most recent published file was reading a list whose newest action was taken in July.

Monthly screening is a recommendation grounded in that cycle. OIG's 2013 Updated Special Advisory Bulletin states that providers "are not required by statute or regulation to check the LEIE". Its 2023 General Compliance Program Guidance gives the reasoning: the list updates monthly, so screening each month best limits overpayment and penalty liability.

A second list runs alongside it. The System for Award Management, maintained by the General Services Administration under 2 CFR 180.510, carries debarment and exclusion actions entered by any federal agency that takes one. The OIG list, in OIG's words, "contains only the exclusion actions taken by OIG".

A one-time Data Bank query answers for the day you ran it

A report filed the week after your query never reaches you. The Data Bank is candid about it: "You will not be notified of any new reports submitted to the NPDB after the initial query date."

Hospitals must query the National Practitioner Data Bank when a practitioner applies for medical staff appointment or privileges, and every two years after that, under 45 CFR 60.17(a). NAMSS goes further, instructing anyone running a credentialing process to "query the Data Bank during the initial credentialing process, and continuously thereafter".

Continuous Query returns "all new or updated report notifications during the year-long enrollment for each practitioner". A hospital whose practitioners are enrolled meets its two-year statutory duty without submitting separate queries.

A single one-time query response and a one-year Continuous Query enrollment both cost $2.50. The two merge into a single service, NPDB Query, on December 4, 2026.

The standard names license expiration as a verification trigger

A license that lapses mid-assignment puts the client out of compliance, and the agency that supplied the clinician is the one asked to explain it. Expiration is named in the standard as a trigger for verification. Joint Commission MS.17.01.03, element of performance 3, requires written primary source verification of current licensure "at the time of initial granting, renewal, and revision of privileges, and at the time of license expiration". HR.11.01.03, element of performance 3, sets the same shape for staff credentials: verification at the time of hire and at the time credentials are renewed. That is two events, with no periodic interval between them.

Renewal cycles cluster at two years, and the anchor date varies from board to board. Some states count from the month the license was issued, others from fixed statewide dates split across groups of licensees. At least one nursing board anchors expiration to the licensee's birth month. One client hospital can hold two clinicians from the same agency whose licenses expire on unrelated calendars.

That makes expiration tracking a compliance mechanism rather than an administrative convenience. Whatever system holds the file needs each dated credential stored as a date it reads, with an alert attached and a named person receiving it. Primary source verification records sit inside that scope, because they age from the day they are completed like everything else in the file. Credentially holds each dated item inside the requirement set built for that client and that role. It tracks the expiration on each one, alerts ahead of the date, and blocks staff with outstanding requirements from booking shifts. The compliance monitoring page covers how the tracking is structured.

The cost of an excluded placement, and the rule that does not reach you

An excluded clinician on a live assignment costs an agency in three separate ways. They get run together and they behave differently.

The payment prohibition is automatic: under 42 CFR 1001.1901(b)(1)(i), no federal health care program payment may be made for any item or service furnished by an excluded individual. That subparagraph carries no knowledge test.

The civil monetary penalty does carry one, and it is constructive. 42 CFR 1003.200(b)(4) reaches any person who "arranges or contracts (by employment or otherwise)" with an individual the person "knows, or should know, is excluded". Arranging for the provision of services is what a staffing agency does, and the agency need not be the employer of record or bill the program.

The regulation prints a $20,000 maximum per item or service at 42 CFR 1003.210(a)(4). HHS adjusts every civil monetary penalty for inflation annually, and the maximum in force after the adjustment published on January 28, 2026 is $25,595. The assessment at 1003.210(b)(2)(ii) is the sharper number: where the work is not separately billable, it can reach three times the total cost of the placement, salary, benefits and taxes included.

Deactivation of Medicare billing privileges under 42 CFR 424.540 does not reach an agency. It applies to enrolled providers and suppliers, and an agency that bills its client is neither, so that exposure sits with the health system client and with any clinician holding their own Medicare enrollment.

Castle Biosciences paid $112,917.55 in January 2026 and Barnet Dulaney Perkins Eye Center paid $175,513.11 in May 2026, both after self-disclosing that they had employed someone they "knew or should have known was excluded". A Utah staffing agency settled on the same wording for $50,000 in 2013.

The same placement file, with every date held as a live date

One record, held to two different standards.

In the first, the file shows a criminal search completed February 12, 2026 and an exclusions check completed the same day, both marked done. The clinician starts on March 9. An exclusion with an effective date of February 20 appears in the supplement published on March 12. Nobody reopens the file, because both lines say complete. From February 20 onward, no federal payment may be made for any item or service that clinician furnishes, under 42 CFR 1001.1901(b)(1)(i). Nobody had to know, and the exposure set out above runs per item or service.

In the second, those two lines are stored as dates with a review date attached rather than as ticks on a checklist. The re-screen sits in the requirement set for the role and falls due on March 15. The alert goes out on March 8, the check is repeated, and the March 16 shift is not booked. Seven days of billed hours are exposed instead of every shift worked until someone reopens the file.

No platform changes how often OIG publishes, and Credentially neither runs the screening nor queries the Data Bank. What a tracking system governs is whether the date attached to each requirement is read in time to act, and whether a booking can be made against a requirement that has fallen due. Requirement sets and expiration dates sit in one record on the credentialing page.

Where this leaves the next assignment you fill

The next clinician you place will arrive with a healthcare staffing background check that was accurate on the day it ran. Each date in that file is the whole of the assurance it offers, and every one of them will be older on the first shift than it was at offer.

So the file has to carry a second answer alongside whether the checks were done: which of its dates are being read, on what cadence, and what happens to a booking when one falls due mid-assignment. Settle that inside the requirement set before the assignment starts. The alternative is settling it during a client's audit, with the placement already invoiced.

References

• NAMSS, The Ideal Credentialing Standards for Initial-Practitioner Applicants, February 2025: https://www.namss.org/Portals/0/NAMSS_1506450-25_ICS-Document-Update-4.pdf
• 15 U.S.C. 1681c, Fair Credit Reporting Act, requirements relating to information contained in consumer reports. The seven-year limit sits at 1681c(a)(2) and (a)(5), the conviction carve-out at (a)(5), and the $75,000 salary exemption at 1681c(b)(3): https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap41-subchapIII-sec1681c.htm
• Joint Commission, Hospital Accreditation Survey Process Guide, copyright 2026, changes effective January 1, 2026, source of NPG.12.04.01, MS.17.01.03 and HR.11.01.03: https://digitalassets.jointcommission.org/api/public/content/64731897e3d94ca69e54042c2e27d9c6?v=19446f24
• 42 CFR 482.13, Condition of participation: Patient's rights, the standard the criminal background check surveyor process sits against: https://www.ecfr.gov/current/title-42/section-482.13
• HHS OIG, Exclusions Program: https://oig.hhs.gov/exclusions/
• HHS OIG, Exclusions frequently asked questions, last updated April 30, 2026: https://oig.hhs.gov/faqs/exclusions-faq/
• HHS OIG, LEIE database and supplement downloads: https://oig.hhs.gov/exclusions/leie-database-supplement-downloads/
• HHS OIG, Updated Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs, May 9, 2013: https://oig.hhs.gov/exclusions/files/sab-05092013.pdf
• HHS OIG, General Compliance Program Guidance, November 6, 2023: https://oig.hhs.gov/documents/compliance-guidance/1135/HHS-OIG-GCPG-2023.pdf
• 2 CFR 180.510, Who maintains SAM.gov Exclusions: https://www.ecfr.gov/current/title-2/subtitle-A/chapter-I/part-180/subpart-E/section-180.510
• 45 CFR 60.17, Requirement to request information from the NPDB: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-60/subpart-C/section-60.17
• NPDB, About querying, source of the one-time query wording, the Continuous Query description, the $2.50 price and the December 4, 2026 merger notice: https://www.npdb.hrsa.gov/hcorg/aboutQuerying.jsp
• NPDB Guidebook, Chapter D, queries: https://www.npdb.hrsa.gov/guidebook/DQA5.jsp
• 42 CFR 1001.1901, Scope and effect of exclusion: https://www.ecfr.gov/current/title-42/section-1001.1901
• 42 CFR 1003.200, Basis for civil money penalties, assessments, and exclusions: https://www.ecfr.gov/current/title-42/section-1003.200
• 42 CFR 1003.210, Amount of penalties and assessments: https://www.ecfr.gov/current/title-42/section-1003.210
• HHS, Annual Civil Monetary Penalties Inflation Adjustment, final rule, 91 FR 3665, published January 28, 2026: https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment
• 45 CFR 102.3, Penalty adjustment and table: https://www.ecfr.gov/current/title-45/section-102.3
• 42 CFR 424.540, Deactivation of Medicare billing privileges: https://www.ecfr.gov/current/title-42/section-424.540
• 42 CFR 424.502, Definitions, source of the provider and supplier definitions: https://www.ecfr.gov/current/title-42/section-424.502
• HHS OIG enforcement action, Castle Biosciences, January 9, 2026: https://oig.hhs.gov/fraud/enforcement/castle-biosciences-agreed-to-pay-112000-for-allegedly-violating-the-civil-monetary-penalties-law-by-employing-an-excluded-individual/
• HHS OIG enforcement action, Barnet Dulaney Perkins Eye Center, May 8, 2026: https://oig.hhs.gov/fraud/enforcement/barnet-dulaney-perkins-eye-center-agreed-to-pay-175000-for-allegedly-violating-the-civil-monetary-penalties-law-by-employing-an-excluded-individual/
• HHS OIG enforcement action, Vital Signs Staffing, LLC, September 26, 2013: https://oig.hhs.gov/fraud/enforcement/vital-signs-staffing-agreed-to-pay-50000-for-allegedly-violating-the-civil-monetary-penalties-law-by-employing-an-excluded-individual/