Healthcare Background Screening: Requirements by Role

A single clinical hire in healthcare can require criminal history, federal exclusion-list screening, primary source verification of licensure, an abuse or nurse-aide registry search, employment and education verification, and drug testing. Which of those apply depends on the role, the setting, the payer, and the state. No single federal rule defines a "healthcare background check," so most of the work is figuring out which requirements attach to which job.

TL;DR

• Five checks form the core: criminal history, federal exclusion lists (OIG LEIE and SAM), licensure verification, employment and education history, and state abuse or nurse-aide registries.
• What applies depends on role, not just employer. Direct patient care, access to residents' living areas, and whether a service is reimbursed each pull different requirements.
• Most guidance gets exclusion screening wrong. OIG states that no statute or regulation requires providers to check the LEIE at any interval. Employing an excluded person still exposes you to civil monetary penalties of up to $25,595 per item or service, plus a treble assessment.
• The federal government sets no criminal-history standard for most private healthcare employers. States do. Florida's Level 2 fingerprint screening under Chapter 435 is the clearest example.
• Employment history takes the longest, because it is the only core check with no authoritative database behind it.

The Five Core Checks

1. Criminal history. County, state, and federal searches plus sex-offender registry checks. For clinical and direct-care roles, many states require a fingerprint-based search through the state police agency and the FBI rather than a name-based one. Note what is absent: the hospital Conditions of Participation require the medical staff to examine candidates' credentials but set no federal criminal-history standard. That comes from state law.

2. Federal exclusion lists. The OIG List of Excluded Individuals/Entities bars individuals and entities from federal health care programs. No federal program payment may be made for items or services furnished by, or ordered or prescribed by, an excluded person. SAM.gov covers federal procurement exclusions and is usually checked alongside it.

3. Licensure and certification. Primary source verification means confirming the credential with the issuing board rather than accepting the candidate's copy. Accreditors expect the verification itself to be documented: the date, who performed it, what was verified, and the result. A photocopy of a license in the file does not satisfy the standard. For nurses, Nursys works as a primary-source equivalent because participating boards contractually designate their daily-updated data that way and authorize NCSBN to act as their agent.

4. Employment and education history. Where the person worked, in what role, for what dates, and whether the credential-granting program was completed. This is the only core check with no queryable authoritative source, covered in detail below. Our comparison of reference checks, background checks, and employment verification explains what each one returns.

5. Abuse and nurse-aide registries. In long-term care this is a federal requirement. Under 42 CFR 483.35(d), before allowing someone to serve as a nurse aide, a facility must receive registry verification that they met competency evaluation requirements, and must seek information from every state registry it believes will hold information on that person. 42 CFR 483.12(a)(3) separately prohibits employing anyone with a registry finding of abuse, neglect, exploitation, or misappropriation.

Hospitals granting clinical privileges also query the National Practitioner Data Bank at appointment and at least every two years after. Drug testing and health screening run alongside all of this, usually through occupational health rather than the screening vendor.

Healthcare Background Check Requirements by Role

Requirements track what a role touches rather than the employer's industry code.

Audit findings cluster in that last row. OIG's guidance says overpayment liability applies regardless of employment status, so contracted and volunteer staff whose work is reimbursed need the same exclusion screening as employees.

The Three Layers: Federal, State, Employer

Federal sets the exclusion baseline, the payment consequence, and the registry check in long-term care. It sets no criminal-history standard for most private healthcare employers.

State supplies the criminal layer. The variation between states is wide, and it is deliberate: the Affordable Care Act's National Background Check Program awarded more than $65 million to 28 states to build their own programs rather than imposing one federal rule.

Florida shows what a state layer looks like. Under Chapter 435 and s. 408.809, Florida Statutes, specified roles in AHCA-licensed facilities require Level 2 screening: a fingerprint-based criminal history check through the Florida Department of Law Enforcement and the FBI, mandatory local law enforcement checks, and a search of sex offender registries in every state where the person lived during the preceding five years. It is submitted via Livescan, processed through the state's Care Provider Background Screening Clearinghouse, and must clear before employment begins.

Three things about Level 2 that most content gets wrong:

• "Level 2" is a Florida term, not a national tier. FDLE says so directly: the FBI and other states don't use it. A vendor offering "Level 2 screening" outside Florida is using the phrase loosely.
• Level 1 and Level 2 share the same disqualifying-offense standard. What differs is the search method and data scope, name-based and state-only versus fingerprint-based, state and national.
• The trigger is broader than patient contact. The statute reaches anyone whose responsibilities may require providing personal care, or who has access to client funds, personal property, or living areas. That covers housekeeping, maintenance, and food service, plus owners, administrators, financial officers, and controlling interests regardless of patient contact.

Florida also requires Level 2 rescreening every five years, treats a break in service of more than 90 days as requiring a new national check, and requires employers to register with the Clearinghouse and report employment status changes within five business days.

Employer and accreditor requirements sit on top of both: accreditor verification standards, payer contract terms, and internal policy that usually exceeds the legal floor.

What OIG Actually Requires for Exclusion Screening

Most guidance says monthly OIG screening is required. It isn't. OIG's Special Advisory Bulletin states that providers are not required by statute or regulation to check the LEIE, that providers may decide how frequently to check it, and that because OIG updates the list monthly, screening employees and contractors each month best minimizes potential overpayment and civil monetary penalty liability.

One citation gets misread in both directions. 42 CFR 455.436 does impose a monthly obligation, but on state Medicaid agencies, which must check the LEIE and the federal exclusion system no less frequently than monthly for providers and their owners, agents, and managing employees. CMS clarified in the rulemaking that this does not require states to make providers screen their own employees and contractors monthly. Many states pass a screening obligation through anyway by rule or provider agreement, so check your state Medicaid agreement before treating the interval as discretionary.

The exposure here is financial rather than a survey citation. The penalty for employing or contracting with an excluded individual runs to $25,595 per item or service, as adjusted for inflation effective January 2026. The assessment on top can reach three times the amount claimed, or for services that aren't separately billable, three times the total cost of the person including salary and benefits. A hospital can be assessed treble the salary of an excluded employee who never billed anything. Because the standard is "knows or should know," your screening interval is worth documenting as a decision rather than leaving to habit.

Why Employment History Takes the Longest

Four of the five core checks have somewhere definitive to look. Exclusion lists, license status, registries, and the NPDB all have an authoritative source. A fingerprint-based state check can take days and county criminal searches vary by jurisdiction, but each has a defined path to an answer.

Employment history doesn't, and healthcare makes it harder than most industries:

• Prior employers are small and numerous. A CNA's last three employers are often two home care agencies and a staffing firm, none of them in any payroll database.
• Turnover keeps the volume high. NSI's 2026 retention report, a self-reported survey of 527 hospitals, puts staff RN turnover at 17.6%, the cost of replacing a single bedside RN at roughly $60,090, and the average time to fill an RN vacancy at 78 days.
• Clinical staffing moves fast. A travel or per-diem placement that waits four days on a verification loses the candidate to another agency. We've written about the same crunch in seasonal hiring, here.
• Agencies close, merge, and rebrand, leaving a former employer that no longer answers a published number. If you want the escalation ladder for employers who never respond, we lay it out in this guide. And if the problem is getting to the right person in the first place, start here.

Credential fraud in healthcare is well documented. In Operation Nightingale, federal prosecutors charged 25 defendants in January 2023 over a scheme that sold more than 7,600 fraudulent nursing diplomas and transcripts through three now-closed Florida schools. Those credentials qualified buyers to sit for the national board exam and obtain licenses and nursing jobs in multiple states. More defendants were charged in a second phase in 2025. Checking that a credential and the work history behind it are real is what catches this, and it is the part with no database.

Where Superunit Fits

Superunit handles employment verifications and reference checks. Its AI agents research the previous employer's contact information independently, then call, email, and fax in parallel, re-attempting across business hours to reach someone who can confirm employment, title, and dates. Every attempt is logged with a timestamp and channel, and calls are recorded and transcribed for full auditability. Results are shared with the requestor when complete. One of the most useful parts of working with Superunit is that you're only charged when a result is actually obtained.

If you want to see how the agents actually work, we walk through a verification start to finish in this guide. For what the resulting record looks like in a compliance file, see our guide to verification audit trails.

What Superunit Does and Doesn't Cover

Superunit does not run criminal history searches, OIG or SAM exclusion screening, primary source license verification, NPDB queries, fingerprinting, abuse or nurse-aide registry checks, or drug testing. It verifies employment history, conducts structured reference interviews, and confirms attendance and completion at high schools and trade or vocational programs. That covers CNA, medical assistant, and similar certificate programs, but not degree verification for RN or physician credentials.

It runs alongside a full-service screening provider rather than replacing one, and it takes the layer a broad platform tends to handle worst. If a vendor tells you one product covers all five checks above, ask how.

Frequently Asked Questions

What does a healthcare background check include? Typically criminal history (often fingerprint-based for clinical and direct-care roles), federal exclusion checks against the OIG LEIE and SAM, primary source verification of any license or certification, employment and education history verification, and state abuse or nurse-aide registry checks. NPDB queries apply to privileged practitioners, and drug and health screening run in parallel.

Do all healthcare workers need a background check? Requirements track what the role touches rather than the job title. Exclusion screening reaches anyone whose services are reimbursed by federal health care programs, including administrative and contracted staff. Criminal and registry requirements generally follow direct patient access or access to residents' property and living areas under state law.

Is monthly OIG exclusion screening required? Not of providers. OIG states there is no statutory or regulatory requirement to check the LEIE and that providers decide how often to check. State Medicaid agencies must check monthly under 42 CFR 455.436, and some states pass that obligation through to providers by rule or contract, so verify your state agreement. Monthly remains common practice because OIG updates the list monthly and the penalty exposure is significant.

What is a Level 2 background check? A Florida statutory term, not a national standard. Under Chapter 435, Florida Statutes, Level 2 is a fingerprint-based criminal history check through FDLE and the FBI with mandatory local checks and a five-year multi-state sex offender registry search, required for specified roles in AHCA-licensed facilities and processed through the state's Clearinghouse.

Do contractors, vendors, and volunteers need screening? For exclusion screening, generally yes, because liability attaches to the reimbursed service regardless of employment classification. Criminal and registry requirements depend on patient access under state law. This population is the most frequent audit gap.

How long do healthcare background check requirements take to satisfy? Exclusion, license, and registry checks usually return quickly. Fingerprint-based state screening adds days, and county criminal searches vary by jurisdiction. Employment verification is the variable one, because it depends on former employers responding, which is why it is usually the item still open when a start date arrives.

Build the Matrix by Role

Background screening in healthcare is five checks whose applicability turns on what a role touches: patients, residents' living areas, or reimbursed services. On top of that sits a state regime supplying the criminal-history mandate the federal government never wrote. Build the matrix by role first, document your exclusion-screening interval as a decision, and plan around the one layer with no database behind it, because that is the one still open when the start date arrives.