Credential OS · Primary Source Verification

Primary Source Verification in 2026: The Expirables Credential OS Watches So You Do Not Have To

One expired license does not announce itself. It slips through on a Tuesday, and you find out ninety days later when a payer claws back every claim the provider touched. Continuous primary-source monitoring turns that scramble into a standing check.

NCQA CR 3 · PSV State License · DEA NPPES · OIG LEIE SAM.gov · Board monitors

The short answer

An "expirable" is any credential with an expiration date: a state license, a DEA registration, a board certification, malpractice coverage, a CDS permit. The old model verifies them at enrollment and again at recredentialing, and prays nothing lapses in between. Credential OS monitors every expirable against its primary source on a continuous cadence, so a lapse is caught the week it happens, not the quarter it costs you.

The cheapest expired license is the one you caught before the claim went out.

Operator's rule · ASP-RCM Credentialing

The cost of one that slips through

A lapse is never a single date. It is a chain of retroactive consequences.

When a license or DEA registration expires mid-cycle, the harm is not "one bad claim." Every service that provider billed while lapsed becomes ineligible, and the recovery lands on you, not the payer.

Retro

Claims paid during the lapse window get recouped. Payers reach back to the expiration date, not the discovery date.

// clawback · refund demand

Blocked

New claims for that provider deny at the front end until the credential is restored and re-verified against source.

// AR aging · revenue stall

Flagged

A lapsed DEA on a controlled-substance script, or an OIG/SAM hit, becomes a compliance event, not a billing one.

// audit exposure · corrective action

Periodic scramble vs. standing check

Same expirable, two ways to find out it lapsed.

The point-in-time model

Verified at enrollmentLicense and DEA checked once, snapshot filed.

Silence for monthsNothing watches the source between checks.

License lapses quietlyRenewal missed. Claims keep flowing.

Recredentialing, up to 36 months laterNCQA requires the recheck at least every three years. That is when you see it.

Payer already found it firstClawback letter arrives before your review does.

Continuous monitoring

Verified at enrollmentSame primary-source check, but it is not the last one.

Source polled on cadenceBoard, DEA, NPPES, OIG and SAM re-queried continuously.

Expiry seen weeks outApproaching dates surface as a work item before they hit.

Renewal driven, not discoveredThe task is opened, owned, and closed against source.

No lapse ever reaches a claimThe provider never bills while unverified.

What "primary source" actually means in 2026

The eight sources Credential OS watches, by name.

NCQA is explicit: verification must come from the issuing source or an approved agent, not a copy the provider hands you. Here is the standing check, source by source.

NCQA CR 3

PSV Standard

Credentialing and Recredentialing standards define what counts as a primary source and the recredentialing cadence of at least every 36 months.

STATE BOARD

Licensure

Each state's medical, nursing or therapy board is the source of truth for active status, expiration and disciplinary actions.

DEA

Registration

DEA registration verified on its roughly three-year cycle, plus any state CDS permit where controlled substances are prescribed.

NPPES

NPI Registry

The CMS NPPES registry confirms the NPI, taxonomy and provider demographics that must match the enrollment on file.

OIG LEIE

Exclusions

The OIG List of Excluded Individuals/Entities is checked so no excluded provider bills a federal program through you.

SAM.gov

Debarment

SAM.gov exclusion records catch federal debarments and suspensions that the LEIE alone does not surface.

MONITOR

Continuous Monitor

Commercial board-source monitoring services feed ongoing sanction and status changes between formal cycles.

FSMB / NPDB

Cross-State + Adverse

FSMB board actions and NPDB adverse-event reports round out the picture beyond a single home-state license.

Two operating models, side by side

Point-in-time PSV vs. continuous primary-source monitoring.

Dimension	Point-in-time PSV	Continuous monitoring
When sources are checked	At enrollment, then at recredentialing	At enrollment and continuously thereafter
How a lapse is found	At the next cycle, or by the payer first	Weeks before the expiration date
Who owns the renewal	Nobody, until it is already late	An opened, tracked work item with an owner
Exposure between cycles	Up to a 36-month blind window	Effectively none; the gap is watched
Evidence for audit	A stale snapshot in a folder	A dated source-verification trail, always current
Failure mode	Clawbacks, front-end denials, compliance events	Caught and closed before a claim is touched

How the standing check runs

The expirable lifecycle, automated end to end.

Ingest

Every credential and its expiration date is registered against its primary source.

Watch

Sources are polled continuously. Board, DEA, NPPES, OIG and SAM stay current.

Alert

Approaching expiries and new sanctions surface as work, weeks ahead.

Act

A renewal task is opened, owned and driven to a re-verified close.

Prove

A dated source-verification trail stands ready for the next audit.

Stop watching the calendar. Let Credential OS watch the sources.

We map every expirable in your provider roster to its primary source, stand up continuous monitoring against NCQA, state board, DEA, NPPES, OIG and SAM.gov, and hand your team a clean queue instead of a quarterly fire drill. No expired license reaches a claim.

Book a Credential OS walkthrough

ASP-RCM Solutions · Senior Partner, Frisco