Hiring Compliance: License Verification, Exclusion Checks and Background Screening
What the law actually requires of a behavioral health employer, what is best practice, and the order to do it in.
Updated September 26, 2026
Three checks protect a behavioral health practice when it hires: the license or certification, the federal exclusion list, and the background check.
They are often bundled into one vendor report, but they answer different questions and carry different rules.
A clean exclusion result does not mean a clean license, a photocopy of a license is not verification, and a blanket criminal-record rule can create its own risk.
This guide sets out each check, what the source actually says, and where a rule ends and best practice begins.
Rules vary by state and change
This guide explains federal rules and the state rules it names, as of the date above.
Licensure, supervision, payer and employment rules differ by state and are revised often, so confirm current requirements with your state board, Medicaid agency, labor department or employment counsel before you act on them.
It is general information, not legal advice.
Verify the license at the primary source, not from a photocopy
The Joint Commission's behavioral health manual is blunt about it: primary source verification is required to confirm that someone holds a valid license, certification or registration when the law requires one, and it is the organization's job, not the clinician's.
A copy of a license card handed over at interview is not verification.
The primary source is the body that issued the credential.
For counselors, social workers, marriage and family therapists, psychologists and substance use counselors, that is the state licensing board.
For nurses and most psychiatric nurse practitioners it is Nursys, which boards of nursing designate as a primary-source-equivalent database, and which offers employers free status alerts through Nursys e-Notify.
Check the state board's own site for a PMHNP licensed in a state whose board does not share APRN data with Nursys; as of September 2026 that included California, New York and Pennsylvania.
For behavior analysts and RBTs, the BACB Certificant Registry shows certification status and reportable disciplinary actions and is updated daily.
In a state that also licenses behavior analysts, the state license is a separate check.
For a counselor practising on a Counseling Compact privilege, check the privilege itself in CompactConnect: a privilege does not update automatically when the home-state license is renewed.
Record the date, who checked, what was checked and the result.
The OIG exclusion list: the ban is law, the check is how you avoid breaking it
Federal health care programs will not pay for items or services furnished by a person excluded by HHS's Office of Inspector General, and that payment ban applies to anyone who employs or contracts with the excluded person, whoever submits the claim.
It reaches administrative, billing, HR and management work, not only clinicians, and it applies to volunteers too.
So in a practice that bills Medicare or Medicaid, the check covers behavioral health technicians, RBTs, peers and intake staff as well as licensed clinicians.
OIG is explicit that no statute or regulation requires a provider to check its List of Excluded Individuals/Entities (LEIE).
What the law penalizes is employing an excluded person for federally payable work: up to $20,000 per item or service in the regulation, inflation-adjusted to $25,595 for 2025, plus an assessment that can reach the excluded employee's salary and benefits.
Checking the LEIE before hire and then periodically is how OIG says to avoid that.
OIG updates the list monthly, which is why monthly screening is its recommendation.
Search every name the person has used, keep a screenshot of the result, and remember that outsourcing the search to a vendor does not move the liability.
The one setting where the question differs is a practice that takes no federal program money at all: OIG says an employer may use an excluded person for work that no federal program pays for, directly or indirectly.
State Medicaid lists, SAM.gov and the NPDB
Some states keep their own Medicaid exclusion list on top of the LEIE.
Texas and New York do, and Texas HHS tells all service providers to check the OIG list monthly and to notify it if a current employee turns out to be excluded.
CMS asked states in 2009 to make monthly provider self-screening a condition of enrollment; whether your state did is a state-by-state question, so check your Medicaid provider agreement.
SAM.gov carries federal debarments from many agencies, including OIG exclusions, but OIG recommends the LEIE as the primary source for its own exclusions and cannot fine you over a SAM-only debarment.
SAM checks usually come into a behavioral health practice through a Medicaid managed care contract or a federal grant, so follow what those documents require.
The National Practitioner Data Bank is not available to most small employers: querying is limited by law to hospitals, health plans and entities that run formal peer review.
It is also not a substitute for exclusion screening or license verification.
Background checks through a screening company: the FCRA steps
When the report comes from a consumer reporting company, the Fair Credit Reporting Act sets the order.
Before ordering it, give the candidate a clear written disclosure in a document that contains only the disclosure, not buried in the application, and get their written authorization.
Before rejecting someone because of the report, send a pre-adverse action notice with a copy of the report and a written summary of their rights.
After the decision, send an adverse action notice naming the reporting company and explaining the right to dispute and to a free copy within 60 days.
Under federal FCRA, a screening company may not report arrests that did not lead to conviction, or most other adverse items, older than seven years for most jobs, but convictions have no federal time limit.
State laws may restrict this further.
Keep hiring records for at least a year and dispose of background reports securely.
State programs often add their own checks.
Florida, for example, requires level 2 fingerprint screening for mental health personnel with direct patient contact and for owners, directors and clinical supervisors of substance use providers.
The BACB requires an RBT candidate to pass a criminal background check and an abuse registry check within set windows before applying.
Criminal records: a targeted screen and an individual assessment
The EEOC's 2012 enforcement guidance, still posted, draws the key line: an arrest does not establish that someone did anything, so excluding a candidate on an arrest alone is not job-related, while a conviction usually is sufficient evidence of the conduct.
The guidance expects a targeted screen that weighs the nature of the offense, the time elapsed and the nature of the job, followed by an individualized assessment: tell the person they may be excluded, let them explain, and consider what they say.
Refusing to hire someone who is on the LEIE is compliance with a federal bar.
A blanket rule such as "no felonies" for a peer specialist, whose lived experience may include the justice system, is a discretionary policy the guidance would analyse.
One caveat on enforcement: an April 2025 executive order directed federal agencies to deprioritize disparate-impact enforcement, which is the basis of much of the 2012 guidance.
The guidance has not been withdrawn, and state fair-chance laws may apply regardless, so write your policy as if it will be read.
A hiring screen in seven steps
- Verify the license or certification at the primary source (state board, Nursys, BACB registry, CompactConnect) and record the date, checker and result.
- Search the OIG LEIE under every name the candidate has used, before hire, and keep the screenshot; re-screen current staff, monthly per OIG's recommendation.
- Check your state Medicaid exclusion list if your state keeps one.
- Check SAM.gov where a managed care contract or federal grant requires it.
- Run the criminal, fingerprint and abuse-registry checks your state program or the credential requires, following the FCRA steps if a screening company runs them.
- Decide on criminal history with a targeted screen and an individualized assessment, not a blanket ban.
- Query the NPDB only if you are an eligible health care entity; otherwise it is not available to you.
Questions employers ask
Do I have to check the OIG exclusion list before hiring?
No statute or regulation requires the check itself, but you must not employ an excluded person for work that Medicare, Medicaid or another federal program pays for, directly or indirectly.
Checking the LEIE before hire and then monthly is how OIG says to avoid the civil monetary penalty.
Some states also make screening a Medicaid provider condition.
Is a copy of a therapist's license enough?
No. The Joint Commission requires primary source verification when a license is required by law, and makes it the organization's responsibility.
Look the license up on the issuing state board's site, or Nursys for nurses and most APRNs, and record the date, who checked, what was checked and the result.
Can we have a no-felony hiring policy?
The EEOC's 2012 guidance treats blanket exclusions as a risk and expects a targeted screen that weighs the offense, the time elapsed and the job, plus an individualized assessment.
Federal bars, such as OIG exclusion, are a defence; a broader discretionary rule is not.
State fair-chance laws may add requirements, so check yours.
Does outsourcing screening to a vendor protect us?
Not from exclusion liability.
OIG says the provider keeps the civil monetary penalty exposure even when a contractor runs the LEIE search, so ask for and keep the vendor's screening documentation.
For background reports from a screening company, the FCRA disclosure, authorization and adverse-action steps are still yours to follow.
More hiring resources
Hiring for a behavioral health practice or program?
Post your opening on BehavioralHires and reach licensed clinicians and support staff.