How to verify a doctor’s medical license status in the US

The Federal Baseline: National Plan and Provider Enumeration System (NPPES)

The National Provider Identifier (NPI) serves as the primary digital fingerprint for healthcare providers in the United States. Mandated by the Health Insurance Portability and Accountability Act (HIPAA) of 1996, this 10-digit numeric identifier is the administrative anchor for all billing and claims transactions. For an investigative reporter or data scientist, the NPI is not a license to practice; it is a pointer. It functions as the “Rosetta Stone” that links a doctor’s records across state lines, hospital systems, and insurance networks. Without an NPI, a physician cannot bill Medicare or Medicaid. Consequently, the CMS NPPES NPI Registry is the only near-universal directory of U. S. physicians.

As of March 2026, the NPPES registry contains over 8 million active records. Accessing this data requires no authentication for basic queries, extracting usable intelligence demands a strict adherence to search syntax and an understanding of the database’s structural limitations. The registry is hosted at npiregistry. cms. hhs. gov.

Decoding the NPI Structure

The NPI is an intelligence-free identifier, meaning the numbers themselves (unlike Social Security numbers or old DEA numbers) do not contain information about the provider’s state or specialty. It is a 10-digit number. The nine digits are the identifier, and the tenth digit is a checksum calculated using the Luhn algorithm (Modulus 10).

The Luhn algorithm, also used for credit card validation, detects transcription errors. When scraping data or verifying a list of NPIs provided by a source, you must validate the check digit to ensure the number is structurally sound before querying the database. A valid NPI currently begins with the digit 1 or 2. CMS estimates that the “1” and “2” prefix capacity suffice for decades.

Entity Types: Distinguishing Doctors from Buildings

The registry categorizes every NPI into two distinct Entity Types. For investigating individual doctors, you must filter for Entity Type 1.

Entity Type	Description	Investigative Relevance
Type 1	Individual Provider (Sole Proprietor)	High. Identifies the specific human being (MD, DO, NP). This record contains the personal license data.
Type 2	Organization (Group, Hospital, Corp)	Low. Identifies the billing entity (e. g., “Main Street Radiology, LLC”). It does not track individual licensure.

A common error in data journalism is confusing a Type 2 NPI (the clinic) with a Type 1 NPI (the doctor). A clinic may remain “Active” in the registry even if the lead doctor’s license is revoked. Always isolate Type 1 records for personnel verification.

Manual Extraction Protocol

For single-target investigations, the web interface provides immediate results. The search logic prioritizes exact matches allows for wildcard searches in specific fields.

Required Input Fields for Precision:

• NPI Number: If known, this is the fastest route.
• /Last Name: Use the exact spelling on the medical degree. If the target uses a nickname, the registry may fail to return a hit unless the provider listed it under “Other Names.”
• State: This filters by the primary practice location. Be aware that doctors licensed in multiple states may only list one primary address in NPPES. A doctor licensed in New York practicing in New Jersey might only appear under a New Jersey search.

The “Other Name” Trap: Physicians frequently change names due to marriage or divorce. The NPPES record includes an “Other Names” section which lists previous legal names or aliases. When investigating a doctor with a clean record under their current name, you must extract all “Other Names” and run independent license verifications on those aliases. Disciplinary actions frequently occur under a prior name.

Automated Extraction via API v2. 1

For verifying lists of doctors (e. g., “Check all 500 staff at City General”), manual entry is inefficient. CMS provides a public Application Programming Interface (API). As of 2026, the active standard is API Version 2. 1. Versions 1. 0 and 2. 0 are retired and return errors.

Endpoint: https://npiregistry. cms. hhs. gov/api/? version=2. 1

Key Parameters:

• number: The 10-digit NPI.
• enumeration_type: Set to NPI-1 to filter for individuals.
• taxonomy_description: Allows filtering by specialty (e. g., “Orthopedic Surgery”).
• limit: Defaults to 10 records; max is 200 per request.

Rate Limiting: June 25, 2024, CMS implemented stricter rate limits to prevent server overload. While the exact threshold fluctuates based on server load, heavy scraping scripts without delays receive 429 Too Requests errors. For datasets exceeding 1, 000 records, CMS mandates using the “Data Dissemination File,” a monthly downloadable CSV file containing the entire database (approx. 9GB unzipped).

Deciphering the Taxonomy Code

The “Provider Taxonomy Code” is a 10-character alphanumeric string that classifies the provider’s specialization. It is maintained by the National Uniform Claim Committee (NUCC). This code is self-reported, meaning a doctor selects it during enrollment. It indicates what the doctor claims to be, not necessarily what they are board-certified in.

Structure of a Taxonomy Code (e. g., 207Q00000X):

• Level 1 (Provider Type): The few characters (e. g., 20 = Allopathic/Osteopathic Physicians).
• Level 2 (Classification): The middle section (e. g., 7Q = Family Medicine).
• Level 3 (Area of Specialization): The specific niche.

Common Physician Taxonomy Codes:

Code	Specialty	Notes
207R00000X	Internal Medicine	General adult medicine.
207RC0000X	Cardiovascular Disease	Sub-specialty of Internal Medicine.
207Q00000X	Family Medicine	General primary care.
208600000X	Surgery	General surgery.

Investigative Warning: A doctor may list “Plastic Surgery” (208200000X) as their taxonomy in NPPES without holding Board Certification in Plastic Surgery. The NPPES taxonomy allows them to bill insurance under that category; it does not prove competence or certification. Always verify the taxonomy against the American Board of Medical Specialties (ABMS) data.

Extracting the State License Number

The primary goal of querying NPPES is to obtain the State License Number. This number is the key to the state medical board’s disciplinary files. In the NPPES record, this data is located in the Provider License Number_1 field, paired with Provider License Number State Code_1.

Extraction Steps: 1. Locate the “Taxonomy” section in the record. 2. Identify the active taxonomy code (marked Y for Primary). 3. Read the associated license number field.

Data Quality problem: Because this data is self-reported, the license number field frequently contains formatting errors. Common problem include: * Prefixes/Suffixes: A doctor might enter “MD12345” instead of just “12345”. * Padding: Leading zeros may be omitted. * Obsolescence: If a doctor moves from Texas to Florida, they may update their address fail to update the license number field to the new Florida license. The record might show a Florida address with a Texas license number.

serious Limitations and Red Flags

Relying solely on NPPES for verification is a procedural failure. The database has distinct vulnerabilities that must be accounted for in any investigative workflow.

The Self-Reporting Bias: The Office of Inspector General (OIG) has repeatedly flagged inaccuracies in NPPES data. A 2024 audit highlighted that while NPIs are unique, the associated data (addresses, taxonomies) relies on the provider to update it within 30 days of a change. Compliance is inconsistent. An “Active” NPI status does not mean the doctor holds an active medical license. It simply means the identifier itself has not been deactivated for fraud or death.

Deactivation Codes: If an NPI is inactive, the record show a deactivation date and code. * Code DT (Death): The provider is deceased. * Code FR (Fraud): The NPI was used in fraudulent activity. * Code VB (Voluntary): The provider retired or dissolved the entity.

Recent Regulatory Changes (2024-2026)

Recent policy shifts have altered the data within the registry. * Gender Options (April 2024): CMS updated the registry to include values “X” (Unspecified) and “U” (Undisclosed) alongside Male and Female. This affects demographic filtering scripts. * Address Privacy (April 2024): Providers without a physical office (e. g., purely telehealth) are permitted to list a post office box or personal mailbox service as their practice location, provided they list their home address in the non-public administrative section. This makes verifying the physical existence of a clinic more difficult for remote-only providers.

Summary of Extraction Data Points

For every target subject, you must extract and store the following data points from NPPES before proceeding to state-level verification:

1. NPI Number: 10 digits.
2. Enumeration Date: When they got the number (approximates career start).
3. Entity Type: Must be 1.
4. Primary Taxonomy Code: The claimed specialty.
5. Provider License Number: The self-reported state ID.
6. Provider License State: The state claiming jurisdiction.
7. Practice Address: For geolocation verification.

Once these identifiers are secured, the investigation moves to the specific State Medical Board (SMB) that issued the license number found in the NPPES record. The NPI registry is the map; the State Board is the territory.

The Legal Authority: State Medical Boards

While the NPI registry tracks billing, the legal authority to practice medicine resides exclusively with State Medical Boards (SMBs). In the United States, there is no single “national medical license.” Instead, 70 distinct medical and osteopathic boards exercise police power over the profession, issuing licenses based on state-specific statutes. As of the Federation of State Medical Boards (FSMB) 2024 Census, released in August 2025, these boards oversee a workforce of 1, 082, 187 actively licensed physicians. For an investigator, the State Board website is the “Primary Source”, the only legally defensible verification point for a doctor’s credentials.

Primary Source Verification (PSV) requires direct confirmation from the issuing authority. Third-party aggregators, including insurance directories and hospital “Find a Doctor” pages, frequently display cached or outdated data. A physician may surrender their license in New York on Tuesday and remain listed as “Active” on a Florida insurer’s website on Friday. To verify a license, you must query the specific state board’s database, hosted on a . gov domain.

The Mechanics of Direct Verification

Each state operates its own verification portal, frequently referred to as a “License Lookup” or “Consumer Information” tool. The standard verification protocol requires a “Three-Point Match” to confirm identity:

1. Full Legal Name: Exact spelling is required. “Jon Smith” not return “Jonathan Smith.”
2. License Number: The unique state-issued identifier (e. g., “A123456”).
3. Location/Specialty: Used to filter common names.

Investigators must distinguish between the Medical Board (for MDs) and the Osteopathic Board (for DOs). While states like New York combine them, others like California maintain separate entities (Medical Board of California vs. Osteopathic Medical Board of California). Failing to query the correct board yields a false negative.

Interpreting License Status Codes

The most dangerous data point in a license record is the “Status” field. A status of “Active” does not guarantee a clean record. Boards frequently use “Active” to denote that fees are paid and the license is not currently revoked, even if the physician is under investigation or probation. You must examine the “Board Orders” or “Public Documents” tab for the full history.

Standardized Medical License Status Definitions (2020-2026)

Status Code	Definition	Investigative Implication
Active	License is valid; physician can practice.	Does not rule out past discipline. Check “Public Actions” history.
Active, Probation	License is valid, practice is restricted or monitored due to disciplinary action.	High risk. Physician may require a chaperone or drug testing.
Suspended	Practice rights are temporarily removed.	results from immediate danger to public health (e. g., substance abuse, sexual misconduct).
Revoked	License is permanently terminated.	The most severe sanction. Physician is stripped of the right to practice in that state.
Surrendered	Physician voluntarily gave up the license.	frequently a negotiated plea to avoid public revocation hearings. Treat as equivalent to revocation.
Administrative Medicine	Active, restricted to non-clinical work (research, insurance review).	Physician cannot treat patients. frequently used by retired or impaired doctors.

Disciplinary Action Trends and Data Lag

Disciplinary actions are rare, and the rate of serious enforcement is declining. According to a Public Citizen report analyzing data from 2021 to 2023, state boards took serious disciplinary actions (revocations, suspensions, surrenders) at a rate of only 0. 81 per 1, 000 physicians. This represents a 12% decrease from the 2019-2021 period.

The variance between states is extreme. Ohio led the nation with 1. 82 serious actions per 1, 000 physicians, while Indiana ranked lowest at 0. 17. For an investigator, this geographic means a “clean” license in Indiana may not indicate the same level of scrutiny as a “clean” license in Ohio.

Investigative Warning: State boards operate with significant data lag. A disciplinary order signed by a board on the 1st of the month may not appear on the public website until the 15th or 30th. In 2024, the FSMB reported 6, 601 total disciplinary actions against 3, 023 physicians. Always check the “Press Releases” or “Monthly Disciplinary Alerts” section of the board website, which frequently lists actions before they populate in the individual search profiles.

The Interstate Medical Licensure Compact (IMLC)

The rise of telemedicine has complicated verification through the Interstate Medical Licensure Compact (IMLC). As of January 2026, 42 states, the District of Columbia, and Guam participate in this compact, which allows physicians to hold licenses in multiple states based on a “State of Principal Licensure” (SPL).

An IMLC license in a secondary state (e. g., Colorado) is legally tied to the status of the license in the SPL (e. g., Arizona). If the Arizona license is revoked, the Colorado license should theoretically terminate. yet, synchronization delays occur.

serious 2026 Update: Michigan is withdrawing from the IMLC March 28, 2026. Physicians relying on a Michigan SPL to practice in other compact states may face immediate licensure gaps. Investigators reviewing credentials in March or April 2026 must verify if a provider’s multi-state authority relied on Michigan’s participation.

FSMB DocInfo vs. State Boards

The Federation of State Medical Boards operates DocInfo. org, a public search tool that aggregates data from all 70 boards. While DocInfo is a secondary tool for identifying which states a doctor is licensed in, it is not a primary source. It receives data feeds from states at varying intervals (daily to monthly). Use DocInfo to build a map of where a doctor has practiced, then visit each specific state board’s website to perform the final Primary Source Verification.

The Federation of State Medical Boards (FSMB): The Central Aggregator

While the NPPES registry confirms a provider exists in the federal billing system, it fails to answer the most important question for patient safety: Is this doctor legally permitted to practice medicine? The National Provider Identifier (NPI) is a financial instrument, not a safety certificate. A physician with a revoked license can technically retain an NPI, and the NPPES database frequently lags in reflecting state-level disciplinary actions. To verify licensure and disciplinary history, an investigator must turn to the Federation of State Medical Boards (FSMB). The FSMB acts as the central data hub for 70 state and territorial medical and osteopathic boards. Its public-facing utility, DocInfo. org, aggregates data from these jurisdictions into a unified search engine. Unlike the fragmented nature of individual state board websites, which vary wildly in searchability and data retention, DocInfo offers a standardized view of a physician’s professional standing.

The Architecture of DocInfo vs. The Physician Data Center

Reporters must distinguish between the FSMB’s two primary data products, as they serve different masters. 1. DocInfo. org (Public): This is the free, consumer-facing portal. It provides licensure status (Active, Inactive, Expired), medical school education, and a binary indicator of disciplinary actions. It does not always provide the full legal text of a board order, it flags the existence of an order. 2. Physician Data Center (PDC) (Industry): This is the paid, business-to-business service used by hospitals, insurance carriers, and credentialing verification organizations (CVOs). The PDC offers continuous monitoring and “Disciplinary Alerts” that notify subscribers within 24 to 48 hours of a state board reporting an action. For an investigative journalist, DocInfo is the starting point, the PDC represents the “gold standard” of data that hospital administrators see.

Analyzing Disciplinary Data: The 2024 Baseline

The rarity of disciplinary action is a statistical reality that complicates investigations. According to the FSMB’s 2024 Census of Licensed Physicians, the United States has 1, 082, 187 licensed physicians. Yet, the number of doctors who face serious discipline is infinitesimally small. In 2024, state boards issued 6, 601 disciplinary actions against 3, 023 physicians. This means less than 0. 3% of the physician workforce faced formal discipline in a given year. This low percentage supports two opposing hypotheses for an investigator: either the vast majority of doctors operate without error, or state boards are hesitant to police their own. Data from consumer advocacy groups suggests the latter. An analysis of 2021-2023 data ranks state boards by the rate of “serious disciplinary actions” (revocations, suspensions, surrenders). Ohio led the nation with a rate of 1. 82 serious actions per 1, 000 physicians. In contrast, large states fell well 1. 0 per 1, 000. This geographic means a doctor’s “clean” record may depend more on where they practice than how they practice.

Step-by-Step Verification Protocol

When querying DocInfo, use the following protocol to extract maximum intelligence: 1. Exact Name Match: Enter the physician’s name exactly as it appears in the NPPES registry. DocInfo is sensitive to spelling variations. 2. Verify the Education: Check the medical school and graduation year. A common fraud tactic, seen in schemes like “Operation Nightingale” (though primarily nursing-focused, the method applies to foreign medical graduates), involves falsified diplomas. If the graduation year on DocInfo does not align with the physician’s claimed age or timeline, flag it. 3. The “Sanctions” Field: This is the serious data point. DocInfo display a section labeled “Disciplinary Actions” or “Sanctions.” * Green Check: Indicates no reported actions. * Red/Orange Flag: Indicates a reported action. If a flag exists, DocInfo frequently provides a link to the specific state board order. If the link is broken or missing, you must manually request the “Board Order” from the specific state medical board using the license number provided.

Interpreting Board Action Codes

State boards use specific legal terminology that can obscure the severity of an offense. A “Consent Order” sounds benign frequently functions as a plea deal where the physician admits to wrongdoing to avoid a public trial.

Common Disciplinary Action Classifications (2020-2026)

Action Type	Severity	Investigative Implication
Revocation	serious	The license is terminated. The physician cannot practice. This is the “death penalty” of medical licensure.
Suspension	High	Practice is prohibited for a set period. frequently follows immediate threats to public safety (e. g., substance abuse, sexual misconduct).
Surrender	High	The physician gives up the license voluntarily, to halt an investigation. Treat this as a functional revocation.
Probation	Medium	The physician can practice under supervision or restrictions. Common for -time substance problem or documentation errors.
Reprimand / Censure	Low	A public “slap on the wrist.” The license remains active and unrestricted.
Administrative Fine	Variable	Monetary penalty. Can range from $500 for missing CME credits to $50, 000 for billing fraud.

The Interstate Medical Licensure Compact (IMLC) Effect

The rise of the Interstate Medical Licensure Compact (IMLC) has altered the speed of disciplinary data. As of 2025, 42 states and territories participate in the Compact. The IMLC creates an expedited pathway for licensure, it also mandates a higher velocity of information sharing. Under the Compact, if a “State of Principal License” (SPL) takes disciplinary action, that information is transmitted to other member states much faster than the traditional board-to-board mail. For investigators, this means a disciplinary action in an IMLC state (like Colorado or Alabama) should theoretically appear on the physician’s records in other Compact states (like Washington or Maryland) with minimal latency. yet, “minimal” does not mean “zero.” There is still a processing gap. A doctor disciplined in Nevada on Monday might not show a flag in the FSMB database until the state board submits its weekly or monthly batch report.

The “Clean Record” Fallacy

A clean DocInfo search does not guarantee a physician is safe; it only guarantees they have not been successfully disciplined. The “lag time” between a patient complaint and a final board order averages 1 to 3 years in jurisdictions. During this investigation period, the physician’s DocInfo profile remain green and “Active.” also, hospitals frequently use “peer review” processes to handle internal misconduct quietly. If a hospital suspends a doctor’s privileges for fewer than 30 days, they are frequently not required to report it to the National Practitioner Data Bank (NPDB) or the state board. This creates a “shadow ” of disciplinary history that never reaches the FSMB.

The “Death Penalty” of Medical Billing: Understanding the OIG LEIE

While the NPPES registry establishes a provider’s identity, the Office of Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) determines their eligibility to exist financially in the U. S. healthcare system. For an investigative reporter or auditor, the LEIE is the “blacklist.” Presence on this list acts as a functional “death penalty” for a medical career, prohibiting the individual from receiving a single cent of federal healthcare funds. This prohibition extends beyond direct billing. It is a radioactive status that contaminates any organization employing the excluded individual. If a hospital hires an excluded surgeon, or even an excluded administrative clerk, to handle data for Medicare patients, that hospital becomes liable for massive Civil Monetary Penalties (CMPs). As of early 2026, the LEIE database contains tens of thousands of active exclusions. It is updated monthly. Unlike the NPI registry, which is a directory of who is practicing, the LEIE is a record of who must not practice on the taxpayer’s dime.

Mandatory vs. Permissive Exclusions: The Legal Triggers

The Social Security Act (Sections 1128 and 1156) categorizes exclusions into two distinct tiers: Mandatory and Permissive. Understanding this distinction is important for analyzing the severity of a provider’s infraction.

Mandatory Exclusions (Section 1128(a))

The OIG must exclude individuals convicted of specific crimes. There is no discretion here; the law requires it. The minimum period is five years, though it is frequently longer.

Triggering Offense	Description	Minimum Term
Program-Related Crimes	Criminal convictions related to the delivery of an item or service under Medicare or Medicaid.	5 Years
Patient Abuse	Conviction relating to neglect or abuse of patients in connection with the delivery of a healthcare service.	5 Years
Felony Healthcare Fraud	Felony convictions for fraud, theft, embezzlement, breach of fiduciary responsibility, or other financial misconduct in healthcare.	5 Years
Controlled Substance Felonies	Felony convictions relating to the unlawful manufacture, distribution, prescription, or dispensing of a controlled substance.	5 Years

Permissive Exclusions (Section 1128(b))

The OIG may exclude individuals for a wider range of offenses. These exclusions are discretionary and variable in length. * Misdemeanor Convictions: Fraud or controlled substance violations that do not rise to the level of a felony. * License Revocation: If a state medical board suspends or revokes a license, the OIG can mirror that action federally. * Student Loan Default: Health education loan defaults can trigger exclusion. * Substandard Care: Providing unnecessary or poor-quality services.

The Active License Paradox

A common investigative error is assuming that a valid state medical license guarantees federal eligibility. This is false. A doctor can possess an active, unrestricted state license and still be on the LEIE. This paradox occurs due to the “lag” between state and federal agencies. While the OIG relies on state boards to report adverse actions, the reverse communication channel is not always immediate. also, a doctor excluded for financial fraud (e. g., student loan default or billing schemes) may not have committed a clinical error that warrants immediate license revocation by a state board. Investigative Rule: Never use a state license verification to clear a doctor for federal program eligibility. You must audit the LEIE separately.

Auditing the Database: Method and Mechanics

The OIG provides two primary methods for accessing LEIE data: the Online Searchable Database and the Downloadable Data File. For data journalism and widespread auditing, the Downloadable Data File is the only viable option.

Step 1: Acquiring the Source Data

Navigate to the OIG HHS website and locate the “LEIE Downloadable Databases” section. You find two relevant files: 1. UPDATED. csv: The complete list of currently excluded individuals. 2. Monthly Supplement: Only the changes (additions/removals) for the current month. Download `UPDATED. csv`. This file contains over 70, 000 rows.

Step 2: Understanding the Data Structure

The CSV file absence headers in raw formats, so you must map the columns according to the OIG’s “Record Layout” documentation. Key fields include: * LASTNAME / FIRSTNAME: The primary identifiers. * DOB: Date of Birth (frequently redacted or limited to year in public files, though the online verification tool uses it). * GENERAL: The provider’s job description (e. g., “MEDICAL PRACTICE, MD”). * SPECIALTY: The medical specialty code. * UPIN: Unique Physician Identification Number (Legacy, largely replaced by NPI). * NPI: National Provider Identifier. Note: Not all excluded individuals have an NPI listed. * ADDRESS: The address on file at the time of exclusion. * EXCLTYPE: The code indicating the legal basis (e. g., “1128a1” for program-related crimes). * EXCLDATE: The start date of the exclusion.

Step 3: The Verification Gap

Matching names from a hospital staff list against the LEIE is with false positives. “John Smith” return multiple hits. The OIG provides a “Verify” function on their website that allows you to input a Social Security Number (SSN) to confirm a match. For Reporters: You likely do not have the target’s SSN. Therefore, you must build a “probability match” using: 1. NPI Cross-Reference: If the LEIE record contains an NPI, cross-reference it with the NPPES registry to match the practice location and medical license number. 2. Address History: Use public records (court documents, property records) to place your subject at the address listed in the LEIE during the exclusion month. 3. DOB Matching: If you have the subject’s DOB from other sources, use the online search tool (which allows DOB input) to narrow the field.

The Financial Consequences: Civil Monetary Penalties (CMP)

The OIG’s enforcement power lies in its ability to levy crippling fines. These Civil Monetary Penalties are adjusted annually for inflation. As per the 2025 adjustment (based on the Federal Civil Penalties Inflation Adjustment Act Improvements Act), the penalties are severe. If an organization employs an excluded individual and bills a federal program for their services: * Base Penalty: The OIG can impose a CMP of approximately $20, 000 to $22, 000 (inflation-adjusted) for each item or service claimed. * Treble Damages: The government can demand an assessment of three times (3x) the amount claimed. * Program Exclusion: The employing entity itself can be excluded from Medicare/Medicaid. Example Calculation: If an excluded nurse administers 1, 000 flu shots billed to Medicare, the chance liability is not just the cost of the shots. It is 1, 000 multiplied by the per-item CMP (approx. $20, 000), resulting in a chance $20 million liability. This mathematical reality forces compliance officers to treat the LEIE with extreme caution.

The Reinstatement Myth

A pervasive misconception is that exclusion expires automatically after the minimum term (e. g., 5 years). This is factually incorrect. The Rule: Reinstatement is an administrative process, not an automatic reset. 1. Application Required: The excluded individual must apply for reinstatement 90 days before their exclusion period ends. 2. Review Period: The OIG review process takes a minimum of 120 days. 3. Denial Risk: If the OIG determines the individual is still a risk (e. g., they have not regained their state license or paid restitution), reinstatement is denied. If a doctor’s 5-year exclusion ended in 2022, they never applied for reinstatement, they remain on the LEIE in 2026. Any hospital hiring them today is liable for CMPs. This “zombie exclusion” status is a frequent trap for negligent credentialing departments.

State Medicaid vs. Federal LEIE: The Data Lag

While the LEIE is the federal baseline, reporters must also recognize the 42+ separate State Medicaid Exclusion Lists. The Affordable Care Act (Section 6501) dictates that if a provider is terminated from one state’s Medicaid program “for cause,” they are terminated from all state Medicaid programs. yet, data synchronization is slow. A provider excluded in Illinois today might not appear on the federal LEIE for months. * The Audit route: For a detailed background check, not rely solely on the OIG LEIE. You must check the specific State Medicaid Exclusion List for every state where the doctor has practiced. * The SAM. gov Distinction: The System for Award Management (SAM) contains debarment data for all federal contracts, not just healthcare. While there is overlap, the LEIE is the primary authority for medical billing eligibility.

The Disciplinary Ledger: Federation of State Medical Boards (FSMB)

While the NPPES registry confirms a provider’s existence, the Federation of State Medical Boards (FSMB) Physician Data Center (PDC) confirms their legitimacy. If the NPI registry is the phone book, the PDC is the rap sheet. As of March 2026, the FSMB maintains the only centralized, national repository of disciplinary actions taken against physicians by the 70 state and territorial medical boards in the United States.

For investigative purposes, the primary interface for this data is DocInfo. org, the public-facing portal of the PDC. Unlike the self-reported data in NPPES, the data in DocInfo is sourced directly from state licensing boards. yet, the update frequency varies: while 61 boards report consistently, the latency between a state order and its appearance in the national database can range from 24 hours to 30 days depending on the jurisdiction’s reporting infrastructure.

Decoding Board Action Alerts

A “Board Action” flag on a physician’s profile is the single most serious indicator of regulatory intervention. It signifies that a state medical board has issued a formal order against the licensee. These are not parking tickets; they are legal findings that frequently follow a formal investigation, hearing, and adjudication process.

FSMB categorizes these actions into two distinct classes. You must distinguish between them to accurately assess the severity of a subject’s record.

1. Prejudicial Actions (The “Red” Flags)

Prejudicial actions directly affect the physician’s legal authority to practice medicine. These are the most severe sanctions and almost always trigger a cascade of consequences, including exclusion from insurance networks and termination of hospital privileges.

• Revocation: The permanent removal of the license. The physician is legally barred from practice.
• Suspension: A temporary prohibition from practice, frequently pending further investigation or completion of remedial programs.
• Surrender: A “voluntary” relinquishment of the license, frequently negotiated to avoid a formal revocation hearing. Treat this as a functional revocation.
• Probation/Restriction: The physician may practice under specific constraints (e. g., no prescribing of controlled substances, mandatory supervision, or prohibition from treating female patients).

2. Non-Prejudicial Actions (The “Yellow” Flags)

These are administrative or corrective actions that do not necessarily suspend the license indicate non-compliance or minor infractions.

• Administrative Fines: Monetary penalties for paperwork errors or late renewals.
• CME Orders: Mandatory Continuing Medical Education required to address a competency gap.
• Reprimands: A formal letter of censure that remains on the permanent record may not restrict current practice.

Investigative Rule: Never assume a “Surrender” is benign. In 2024, over 15% of all serious disciplinary outcomes were recorded as surrenders. This is frequently a strategic legal maneuver to seal the investigative file while exiting the jurisdiction.

Verified Disciplinary Metrics (2020, 2024)

To contextualize a specific doctor’s record, you must understand the baseline frequency of discipline. The rate of serious disciplinary action in the U. S. is statistically low, meaning any presence of a board action places a physician in a distinct outlier group.

According to the FSMB’s 2024 U. S. Medical Regulatory Trends and Actions report, the volume of disciplinary actions has stabilized even as the physician population grows.

Table 5. 1: U. S. Physician Disciplinary Actions (2024 Reporting Year)

Metric	Verified Count	Investigative Context
Total Disciplinary Actions	6, 601	Includes all severity levels (fines to revocations).
Physicians Disciplined	3, 023	~0. 3% of the licensed workforce received discipline in 2024.
-Time Offenders	1, 507	50% of disciplined doctors had no prior public record.
Serious Actions (Revocation/Suspension)	~1, 200	Less than 20% of actions result in total practice stoppage.

The “Alert Loop” and Cross-State Discipline

Physicians frequently hold licenses in multiple states to facilitate telemedicine or locum tenens work. The FSMB operates the Disciplinary Alert Service (DAS) to prevent “jurisdiction hopping”, where a doctor disciplined in Ohio moves to Texas to practice with a clean slate.

When a board problem a prejudicial order, the DAS triggers a notification to every other board where that physician holds a license. This frequently results in “reciprocal actions,” where State B disciplines the doctor solely based on the findings of State A.

Investigative Tactic: If you find a disciplinary order in one state, immediately query the FSMB/DocInfo profiles for every other state listed in the doctor’s NPPES record. You frequently find a chain of reciprocal orders, or conversely, a “gap” where a state has failed to act on the alert, a significant story in itself.

Fan-Out: 20 Key Verification Questions

Use these questions to interrogate the FSMB data and validate the status of a medical license.

1. What is the primary public portal for FSMB data? DocInfo. org.
2. What is the difference between a “Board Order” and a “Board Action”? A Board Order is the legal document detailing the decision; the Board Action is the specific sanction (e. g., suspension) derived from that order.
3. How disciplinary actions were issued in 2024? State boards issued 6, 601 actions against 3, 023 physicians.
4. Does a “Surrender” count as a disciplinary action? Yes, it is classified as a prejudicial action, frequently used to resolve an investigation without a hearing.
5. What is the “Disciplinary Alert Service” (DAS)? A system that notifies state boards within 24-48 hours when a licensee is disciplined in another jurisdiction.
6. Are malpractice settlements listed in DocInfo? Generally, no. Malpractice settlements are civil matters and only appear if they trigger a separate state board investigation and subsequent action.
7. What does “Prejudicial” mean in FSMB terminology? It refers to actions that modify, suspend, or revoke the license, directly impacting the ability to practice.
8. What is the latency of FSMB data? Most boards report monthly; yet, the DAS pushes alerts to boards within 24-48 hours of receipt.
9. Can a physician expunge a board action from the FSMB record? Extremely rare. Board actions are permanent regulatory records, though states may expunge minor administrative citations after a set period.
10. Does the FSMB track actions by the VA or DoD? Yes, the PDC integrates disciplinary data from federal agencies including the DoD, VA, and HHS.
11. What percentage of physicians receive discipline annually? Approximately 0. 25% to 0. 35% of the licensed workforce.
12. What is a “Reciprocal Action”? A disciplinary action taken by one state board based solely on the fact that another state board has already disciplined the licensee.
13. How do you verify if a license is “Active” vs. “Active-Probation”? The DocInfo profile explicitly state “License Status: Probation” or list a “Board Action” banner if the active status is conditional.
14. Do “Administrative Fines” appear as red flags? They appear as board actions are classified as non-prejudicial unless accompanied by other sanctions.
15. What is the “Alert Service” for credentialers? A subscription service that proactively notifies hospitals and health plans of new disciplinary actions against their rostered physicians.
16. How physicians were disciplined for the time in 2024? 1, 507 physicians.
17. Does DocInfo show the full text of the Board Order? No, it provides a summary and a link to the specific state board’s website for the full PDF document.
18. What is the most common severe disciplinary action? Suspension and probation are more common than outright revocation.
19. Are substance abuse diversion programs listed? no. states have “Physician Health Programs” (PHPs) that allow confidential treatment without public reporting if the physician complies voluntarily.
20. How does the Interstate Medical Licensure Compact (IMLC) affect discipline? It accelerates the sharing of disciplinary data, as maintaining a clean record is a statutory requirement for IMLC eligibility.

The 10-Character Signal: Decoding NPI Taxonomy

The National Provider Identifier (NPI) taxonomy code is the single most misunderstood metric in healthcare data. While patients and even novice reporters assume this 10-character alphanumeric string represents a verified medical license or board certification, it does not. It is a billing classification. Managed by the National Uniform Claim Committee (NUCC), the Health Care Provider Taxonomy Code Set allows providers to self-identify their specialty for insurance claims. As of the January 2, 2026 update, the NUCC maintains this list, yet the Centers for Medicare & Medicaid Services (CMS) does not validate a provider’s selection against their actual board certification during the NPI enumeration process. This creates a massive verification gap: a physician licensed in General Practice can legally select the taxonomy code for “Plastic Surgery” in the NPPES registry if they believe it represents their current billing focus, even without a single day of residency training in that specialty. For investigative editors, this self-attestation is the primary vector for “specialty drift”, where providers project an image of specialized expertise that contradicts their verified training.

The NUCC Hierarchy: Reading the Code

To audit a doctor’s claims, you must decode the signal. The taxonomy code is not random; it follows a strict hierarchical logic designed for the X12N health care transaction standard. It consists of three levels: Provider Type, Classification, and Area of Specialization. The code is always 10 characters: ten alphanumeric positions. The structure breaks down as follows:

Level	Description	Example Segment	Meaning
Level I	Provider Grouping	20	Allopathic & Osteopathic Physicians
Level II	Classification	82	Plastic Surgery
Level III	Specialization	00000X	General Plastic Surgery (No sub-specialty)

A complete code like 208200000X identifies a physician claiming to be a Plastic Surgeon. A code like 207Q00000X identifies Family Medicine. The difference is not just administrative; it dictates which insurance billing buckets the provider attempts to access.

The “Cosmetic” Loophole and High-Risk Codes

The most frequent abuse of taxonomy codes occurs in high-revenue aesthetic fields. The NUCC does not maintain a specific Level II classification for “Cosmetic Surgeon” because cosmetic surgery is considered a competency within Plastic Surgery (208200000X), Dermatology (207N00000X), or Otolaryngology (207Y00000X). Consequently, General Practitioners (208D00000X) who pivot to performing liposuction or hair transplants frequently face a choice: retain their accurate General Practice code and risk lower reimbursement or denial for specialized procedures, or select the Plastic Surgery code (208200000X) to align with their marketing. When you find a doctor marketing themselves as a “Board Certified Cosmetic Surgeon,” check their NPI taxonomy. If they are listed as 207Q00000X (Family Medicine) or 207R00000X (Internal Medicine), they are billing as a primary care provider while marketing as a surgeon. If they are listed as 208200000X (Plastic Surgery) are not found in the American Board of Plastic Surgery database, they have likely “upcoded” their NPI profile to match their business card, a gap that warrants immediate scrutiny.

Verified Taxonomy Codes for 2026

Use this reference table to cross-check a subject’s claimed specialty against their NPI filing. These codes reflect the NUCC version 26. 0, January 1, 2026.

Specialty Claim	Correct NPI Taxonomy Code	Common “Drift” Origin
Plastic Surgery	208200000X	General Surgery (208600000X) or Family Med (207Q00000X)
Dermatology	207N00000X	Internal Medicine (207R00000X)
Pain Medicine	208VP0014X	Anesthesiology (207L00000X) or Phys. Med & Rehab (208100000X)
Cardiology	207RC0000X	Internal Medicine (207R00000X)
Addiction Medicine	207RA0401X	Family Medicine (207Q00000X) or Psychiatry (208400000X)

Investigative Protocol: The Taxonomy Crosswalk

To verify if a provider is misrepresenting their credentials through NPPES, execute the following “Taxonomy Crosswalk” protocol. This method isolates the gap between federal billing data and state licensure. Step 1: Extract the Primary Taxonomy Query the NPPES registry for your target. Scroll to the “Taxonomy” section. Note the code listed as “Primary.” A provider can have multiple codes, only one is primary. Example: Dr. Smith lists 208200000X (Plastic Surgery) as Primary. Step 2: Verify the Definition Source The NUCC explicitly states: “You do not need to have that source’s certification to choose the code.” This disclaimer is the investigative key. The code 208200000X is defined by the American Board of Plastic Surgery (ABPS), the NUCC allows non-ABPS doctors to use it. Step 3: Run the Board Search Go to the American Board of Medical Specialties (ABMS) or the specific board defined by the taxonomy. Search for Dr. Smith. Result: Dr. Smith is not in the ABPS database. He is Board Certified in Internal Medicine. Step 4: Identify the Gap Dr. Smith is an Internist (207R00000X) masquerading as a Plastic Surgeon (208200000X) in the federal registry. This is not illegal per se under HIPAA, as the NPI is a billing identifier, it is a serious data point for establishing a pattern of deceptive marketing or scope-of-practice expansion.

Data Warning: Do not confuse the “Medicare Specialty Code” with the “NPI Taxonomy Code.” The Medicare Specialty Code is a 2-digit number (e. g., “91” for Medical Oncology) assigned by Medicare Administrative Contractors (MACs) based on the taxonomy. The NPI Taxonomy is the upstream source data. Always cite the 10-character NPI taxonomy in your reporting to maintain precision.

Frequency of Updates and Data Latency

The NUCC updates the code set twice annually, in January and July. The most recent update, Version 26. 0, was released on January 2, 2026. yet, providers are not automatically updated. A doctor who changed specialties or lost certification in 2022 might still carry a 2020 taxonomy code in 2026 if they have not manually logged into NPPES to edit their profile. This “data rot” is a secondary investigative angle. If a doctor was sanctioned by a state board and lost their license to practice surgery, their NPI record frequently remains active with the Surgery taxonomy code for months or years until CMS deactivates the NPI entirely. Comparing the “Last Updated” date in the NPPES record against the date of a disciplinary action can reveal how long a sanctioned doctor continued to present themselves as a specialist in the federal system.

Fan-Out: 20 Questions to Ask of Taxonomy Data

1. What is the primary taxonomy code listed? (Identifies the main billing intent). 2. Are there secondary codes? (frequently reveals the “true” base specialty, e. g., Family Med listed secondarily to a cosmetic claim). 3. Does the taxonomy match the state license scope? (A naturopath using a physician code is a red flag). 4. Is the code active in the current NUCC version? (Retired codes indicate a stale record). 5. Does the provider type (Level I) match the degree? (MD/DO vs. NP/PA). 6. Is the specialization (Level III) board-certified? (Cross-reference ABMS). 7. When was the taxonomy last updated? (Recent updates suggest active management; old dates suggest dormancy). 8. Is the code a “catch-all”? (Codes ending in “General Practice” frequently hide a absence of specialization). 9. Does the taxonomy align with the practice address? (Surgery codes at a residential address). 10. Are multiple distinct specialties claimed? (e. g., Cardiology AND Dermatology, highly unlikely). 11. Does the code require a specific state license endorsement? (e. g., Pain Management in states). 12. Is the provider using a “Group” taxonomy as an individual? (Administrative error or obfuscation). 13. Does the taxonomy match the services advertised on their website? 14. Are they using a generic “Physician” code (200000000X)? (Lazy data entry or hiding specifics). 15. Is the taxonomy consistent across different practice locations? 16. Does the Medicare Specialty Code (derived from taxonomy) match the claims history? (Requires CMS utilization data). 17. Has the taxonomy changed? (Indicates a shift in business model). 18. Is the provider billing for “Cosmetic” procedures under a “Therapeutic” code? 19. Does the taxonomy imply hospital privileges the doctor does not possess? 20. Is the taxonomy code valid for the provider’s state? ( Medicaid programs restrict certain codes).

The National Provider Identifier is the starting line. It is not the finish. While the NPPES registry confirms a provider exists in the federal billing ecosystem, it does not confirm competence, current standing, or the absence of criminal history. A valid NPI can coexist with a revoked state license. To determine if a doctor is legally and ethically cleared to touch patients, you must execute a rigorous Primary Source Verification (PSV) protocol.

The 20-Point Credential Validation Matrix

Investigative rigor demands a systematic method. Use this 20-point interrogation grid to audit any physician’s credentials. If not answer “Yes” or “Verified” to these questions, the subject requires immediate, deeper scrutiny.

Category	Validation Query	Target Data Source
Identity	1. Does the NPI name match the State License name exactly?	NPPES / State Board
	2. Is the DEA registration active and linked to the correct address?	US DOJ DEA / NTIS
	3. Does the SSN (if available) map to the provider’s known history?	Public Records / LexisNexis
	4. Are there aliases or maiden names hidden in the file?	State Board Applications
Licensure	5. Is the primary state license status “Active” without restrictions?	State Medical Board (SMB)
	6. Are there expired licenses in other states?	FSMB DocInfo
	7. Is the license problem date consistent with graduation years?	SMB / CV Cross-check
	8. Has the provider ever withdrawn an application to avoid denial?	SMB Meeting Minutes
Discipline	9. Does the OIG LEIE list the provider as excluded?	HHS OIG LEIE
	10. Does SAM. gov show any federal debarment?	SAM. gov
	11. Are there public board orders or consent agreements?	SMB Disciplinary Database
	12. Is the provider flagged in the FDA Debarment List?	FDA Regulatory Compliance
Education	13. Is the medical school listed in the World Directory of Medical Schools?	WDOMS
	14. Did the residency program accredit the specific training years?	ACGME Data
	15. For IMGs: Is the ECFMG certification valid and permanent?	ECFMG / MyIntealth
	16. Are there unexplained gaps in the training timeline?	CV Analysis
Certification	17. Is the board certification from an ABMS or AOA member board?	Certification Matters / AOA
	18. Is the certification “Maintenance of Certification” (MOC) current?	Specialty Board Search
	19. Is the certifying board a recognized entity or a “vanity” board?	ABMS / Non-ABMS Check
Practice	20. Do hospital privileges match the claimed specialty?	Hospital Staff Directories

State Medical Boards: The Regulatory Ground Truth

In the United States, the authority to practice medicine is a state-level privilege. There is no “federal medical license.” Consequently, the 70 state and territorial medical boards serve as the arbiters of a physician’s legal standing. You must verify the license in every single state where the doctor has ever practiced. A revoked license in Ohio does not automatically trigger an immediate suspension in Kentucky due to reporting lags.

The Federation of State Medical Boards (FSMB) 2024 Census reports 1, 082, 187 licensed physicians in the U. S., a 27% increase since 2010. With 24% of physicians holding licenses in multiple jurisdictions, the “license hopping” phenomenon, where a disciplined doctor moves to a new state before records catch up, remains a serious investigative blind spot. The Interstate Medical Licensure Compact has accelerated cross-state licensing, yet it also increases the complexity of tracking disciplinary actions.

Disciplinary Reporting Latency

State boards vary wildly in their transparency and speed. A 2024 analysis by Public Citizen ranked state boards by their rate of serious disciplinary actions. The data shows a disturbing. The Ohio State Medical Board, for instance, disciplined physicians at a rate 11 times higher than the Indiana Medical Licensing Board. This does not mean Ohio doctors are worse; it means the Ohio board is more aggressive in enforcement. When investigating a doctor with a clean record in a “low-enforcement” state, you must remain skeptical. Absence of evidence is not evidence of competence.

Federal Exclusion Lists: The “Death List” Check

A clean state license does not guarantee a doctor can bill for services. The Office of Inspector General (OIG) maintains the List of Excluded Individuals/Entities (LEIE). This is the federal “do not touch” list. If a provider appears here, they are banned from all federally funded healthcare programs (Medicare, Medicaid, TRICARE). Employing an excluded individual can cost a hospital $10, 000 per day in civil monetary penalties.

As of early 2026, the LEIE database is updated monthly. Common reasons for exclusion include:

• 1128(a)(1): Conviction of program-related crimes (fraud).
• 1128(a)(2): Conviction relating to patient abuse or neglect.
• 1128(b)(4): License revocation or suspension by a state board.

You must also check the System for Award Management (SAM. gov). While LEIE focuses on healthcare, SAM. gov covers all federal contracts. A doctor debarred for student loan fraud or research grant theft appear here. Cross-reference these lists against the NPI registry. A provider with an active NPI yet an active LEIE exclusion is a walking red flag for billing fraud.

DEA Registration and the Checksum Algorithm

Every doctor prescribing controlled substances must hold a Drug Enforcement Administration (DEA) registration. This number is frequently forged. mathematically verify a DEA number’s validity using its internal checksum algorithm. A DEA number consists of two letters followed by seven digits (e. g., AB1234567).

The Verification Formula

1. Step 1: Add the 1st, 3rd, and 5th digits.
2. Step 2: Add the 2nd, 4th, and 6th digits, then multiply the sum by 2.
3. Step 3: Add the results of Step 1 and Step 2.
4. The Check: The last digit of this final sum must match the 7th digit of the DEA number.

Example: For DEA number AB1234563:
Step 1: 1 + 3 + 5 = 9
Step 2: (2 + 4 + 6) * 2 = 24
Step 3: 9 + 24 = 33
The last digit is 3. The 7th digit of the DEA number is 3. The number is mathematically valid. If the math fails, the number is fake.

Board Certification: The Gold Standard vs. The Participation Trophy

Do not confuse “licensed” with “board certified.” Licensure is the minimum legal requirement. Board certification indicates a higher level of specialty training. The American Board of Medical Specialties (ABMS) is the recognized gold standard. According to the ABMS 2023-2024 Board Certification Report, there are 997, 864 active diplomates in the US.

Beware of “self- ” boards. physicians create their own certifying bodies to sound impressive. Always verify certification through the official ABMS “Certification Matters” portal or the American Osteopathic Association (AOA) for DOs. If a doctor claims to be “Board Certified in Cosmetic Surgery” is not certified by an ABMS member board (like the American Board of Plastic Surgery), they may be operating with a credential that absence rigorous peer-reviewed standards.

International Medical Graduates (IMGs)

For the 23% of the U. S. physician workforce who are International Medical Graduates, verification adds another. The Educational Commission for Foreign Medical Graduates (ECFMG) validates these credentials. In 2025, ECFMG transitioned to the “MyIntealth” platform, centralizing data for IMGs. You must confirm that an IMG holds a valid ECFMG certificate. Without it, they cannot legally enter a U. S. residency program or obtain an unrestricted license. Be alert for “clinical gaps” in an IMG’s history, which frequently indicate visa problem or failed residency attempts.

The National Practitioner Data Bank (NPDB) Black Box

The National Practitioner Data Bank contains the most damaging information on doctors: malpractice payouts and hospital privilege revocations. Federal law keeps this database closed to the public. not query it directly. Yet see its shadow. When a state board takes action, they frequently cite an “NPDB report” as the trigger. Use the “Public Use Data File” (PUF) from the NPDB for statistical context. The PUF is de-identified allows you to see if a specific hospital or state is reporting adverse actions at a normal rate. If a hospital system has zero reports in five years, they are likely suppressing data.

The Forensic Timeline: Mapping Licensure Dates Against Employment History

The curriculum vitae (CV) is a marketing document; the state medical board record is a legal instrument. In investigative journalism and high- credentialing, the gap between these two documents is where fraud hides. A physician’s resume may claim continuous employment from 2020 to 2026, a forensic analysis of their licensure history frequently reveals gaps, suspensions, or periods of unlicensed practice. We call this process “Forensic Timeline Construction.”

To verify a doctor’s status, not simply look at their current standing. You must construct a chronological grid that overlays three distinct datasets: Self-Reported Employment (CV/LinkedIn), Legal Authorization (State License History), and Verified Activity (Billing/Open Payments). When these lines do not intersect, you have identified a target for deeper investigation.

The Three-Column Verification Grid

The most method for detecting anomalies is the construction of a temporal grid. For every month in the target period (January 2020 , Present), you must populate three columns. If a physician claims to be working at a hospital in a specific month, their license in that state was “Expired,” “Inactive,” or “Revoked,” they have chance committed insurance fraud or battery (practicing without consent).

Data Point	Source	Investigative Significance
NPI Enumeration Date	NPPES Registry	The “Birth Certificate” of their billing identity. Activity prior to this date is impossible for legitimate billing.
License problem Date	State Medical Board	The legal start date. Employment claiming to start before this date (outside of residency) is a red flag.
License Expiration/Renewal	FSMB / State Board	The “Lapse Window.” Doctors frequently practice through administrative lapses.
Open Payments Date	CMS. gov	“Proof of Life.” If a doctor accepted a pharma lunch in NY while unlicensed in NY, they were physically present and professionally active.
Medicare Billing Activity	CMS Care Compare	Verifies if they were seeing patients during a license suspension.

Red Flag 1: The “Pre-License” Practice Gap

A common anomaly occurs when a physician claims to have started a role as an “Attending Physician” or “Medical Director” months before their state license was issued. While residents and fellows operate under a training license (or a hospital’s institutional license), a fully qualified physician must hold an unrestricted state license to practice independently.

If a subject’s CV states they became “Chief of Surgery” in Florida in January 2024, the Florida Department of Health shows their license problem date as April 2024, you must ask: What were they doing for those three months?

Possibilities include:

• Administrative Delay: They were hired performed only administrative duties (non-clinical).
• Illegal Practice: They began treating patients under the assumption the license was “on the way.”
• Resume Fraud: They inflated their tenure to hide a gap in employment elsewhere.

Red Flag 2: The “Lapse” Window and Billing Fraud

Physicians are required to renew licenses every 1, 3 years, depending on the state. Administrative lapses are common dangerous. If a license expires on December 31, 2024, and is not renewed until March 1, 2025, the physician is legally unlicensed for January and February.

The Investigative Pivot: Cross-reference this “Lapse Window” with the CMS Open Payments Database. The 2024 Open Payments data (released June 30, 2025) and the upcoming 2025 data (scheduled for June 30, 2026) provide granular dates of interaction.

Example Scenario: Dr. X’s Ohio license lapsed from Jan 1, 2025, to Mar 1, 2025. A search of CMS Open Payments shows Dr. X received a $45 “Food and Beverage” payment from a device manufacturer on Feb 14, 2025, listed at a hospital address in Cleveland. This confirms Dr. X was not only present presenting themselves as a physician during a period of unlicensed status. This is actionable evidence of practicing without a license.

Red Flag 3: The Telehealth “Cliff” (Post-May 2023)

The COVID-19 Public Health Emergency (PHE) ended on May 11, 2023. During the PHE, states waived licensure requirements, allowing out-of-state doctors to treat patients via telehealth. When the PHE expired, these waivers dissolved, creating a massive compliance cliff.

telehealth companies failed to update their credentialing fast enough. An investigator should examine any telehealth provider’s activity between June 2023 and December 2024. If a doctor based in Texas was treating patients in California during this window, they required a full California license. The “COVID waiver” defense is no longer valid for activity after May 2023.

Recent enforcement actions highlight the severity of this gap. In 2025, the Department of Justice charged 36 individuals in a $1. 2 billion telemedicine fraud scheme, specifically targeting providers who ordered unnecessary genetic testing across state lines without proper authorization. The timeline of these charges frequently correlates directly with the expiration of pandemic-era waivers.

Case Study: The Recidivist “Doctor”

The need of timeline verification is underscored by the case of Carlos Hernandez Fernandez. Originally imprisoned in 2017 for performing plastic surgery without a license in Colorado, Fernandez was released and, according to September 2025 reports, allegedly resumed illegal practice. Investigators found he had set up a new clinic and was consulting with patients for “revision” surgeries.

A simple timeline check would have protected patients:

1. 2017: License Revoked / Prison Term Start.
2. 2024/2025: New Clinic Opens.
3. Verification: A query of the Colorado Medical Board would show zero active licenses for Fernandez in 2025.

Similarly, in Florida, Juan Carlos Ignacio Munoz Melgar was arrested in late 2023 for practicing without a license, posted bond, and was re-arrested in 2024 for continuing to see patients. These cases demonstrate that a “Revoked” status is not a physical barrier to practice; it is a legal one. Only continuous monitoring of the timeline detects the recidivism.

Using the FSMB Physician Data Center (PDC)

For large- investigations involving multiple doctors, the Federation of State Medical Boards (FSMB) offers the Physician Data Center (PDC). Unlike public board websites which may lag, the PDC receives data updates from state boards at different frequencies:

• Daily/Weekly: High-volume states (CA, TX, FL, NY).
• Monthly: Smaller jurisdictions.

The PDC allows for a “Disciplinary Alert Service.” If you are tracking a specific doctor, subscribe to receive an immediate notification if any board, anywhere in the US, takes action against them. This is important for catching “state hoppers”, doctors who lose a license in one state and immediately move to another, hoping the data has not yet synchronized.

The “Ghost” Period: Resume Gaps

When a doctor is suspended, they rarely list “Suspended” on their LinkedIn profile. Instead, they frequently extend the dates of their previous employment or list “Private Practice” or “Consultant” during the disciplinary window.

Detection Technique: If a doctor lists “Independent Consultant” from 2022 to 2023, check the state board actions for that exact year. A suspension of 12 months frequently aligns perfectly with a vague “sabbatical” or “consulting” role on a CV. also, check the OIG List of Excluded Individuals/Entities (LEIE). A provider excluded from Medicare for fraud be unemployable at major hospitals, forcing them into “consulting” roles or cash-only clinics.

Visualizing the Data Gap

The chart illustrates a typical “Gap Analysis” for a problematic provider. Note the misalignment between the CV claims and the official State Board status.

Time Period	CV Claim (LinkedIn)	State Board Status	CMS Open Payments	Verdict
Jan 2023, May 2023	Hospitalist, Mercy General	Active	$150 (Meals)	Verified
June 2023, Dec 2023	Hospitalist, Mercy General	Suspended (DUI)	$0	Fraud (Resume)
Jan 2024, Mar 2024	Private Consultant	Probation	$12 (Training)	Restricted Practice
April 2024, Present	Attending, City Clinic	Active	$500 (Speaking)	Verified

In the example above, the physician lied about their employment during the suspension period (June, Dec 2023). While they were not billing Medicare (indicated by the absence of Open Payments data), they falsely claimed to be employed by the hospital, which exposes the hospital to liability if they were actually working, or exposes the doctor to fraud charges if they used that false employment history to gain credentials at their job (City Clinic).

The Gold Standard: Medical Staff Services (MSS)

Online physician directories are statistically unreliable. A 2024 study published in the American Journal of Managed Care found that over 40% of provider listings contained errors, with insurers showing inaccuracy rates as high as 80%. These databases frequently list retired doctors as active, wrong specialties, or outdated hospital affiliations. For verified accuracy, you must bypass consumer-facing websites and contact the hospital’s internal gatekeepers: the Medical Staff Services Department (MSSD).

The MSSD is the only department legally mandated to perform Primary Source Verification (PSV). Under strict standards set by The Joint Commission and the National Committee for Quality Assurance (NCQA), this unit must verify every credential directly with the original issuer, medical schools, residency programs, and licensing boards, before a doctor can treat a single patient. If a doctor loses their license or faces disciplinary restriction, the MSSD knows immediately. The marketing department does not.

Investigative Protocol: The MSSD Phone Script

Medical Staff Services departments operate under strict confidentiality laws (such as California Evidence Code 1157), designed to protect peer review files. They not release a doctor’s full disciplinary history to a patient. yet, they must confirm specific, public-interest facts regarding access to care. extract verified status updates by asking precise, binary questions.

Use this script to verify a doctor’s current standing. Do not ask open-ended questions like “Is this doctor good?” or “Have there been complaints?” These trigger immediate privacy blocks.

Caller: “I am a prospective patient verifying the active status of Dr. [Name]. I need to confirm three specific data points before scheduling surgery.”

1. Active Staff Category: “Is Dr. [Name] currently an ‘Active’ member of the medical staff, or are they ‘Courtesy’ or ‘Locum Tenens’?”

Why this matters: “Active” members admit patients regularly and vote on hospital policies. “Courtesy” members rarely admit patients. “Locum Tenens” are temporary contractors, frequently filling gaps for staffing absence.

2. Admitting Privileges: “Does this doctor currently hold admitting privileges for [Specific Procedure, e. g., Neurosurgery] at your facility?”

Why this matters: A doctor may be on staff restricted from performing specific high-risk procedures due to past errors or absence of recent volume.

3. Good Standing: “Is the doctor currently in ‘good standing’ with no active suspensions or limitations on their practice?”

Why this matters: “Good standing” is a specific regulatory term. If the answer is “No,” or “I cannot confirm that,” it is a red flag indicating an ongoing investigation or administrative suspension.

Interpreting the Response

MSSD personnel are trained to be guarded. Their responses, or refusal to answer, provide data.

MSSD Response	Translation	Action Required
“Dr. X is on active staff and in good standing.”	Verified. The doctor has passed all PSV checks and has no current restrictions.	Proceed with care.
“Dr. X is on staff, I cannot verify privileges for that specific procedure.”	The doctor may be credentialed for general medicine not the specialized surgery you need.	Request the doctor’s “Delineation of Privileges” form directly from their office.
“We have no record of that provider.”	The doctor has no legal right to treat patients at this hospital, even if their website claims otherwise.	Do not proceed. Report the gap to the state medical board.
“I cannot answer questions about standing.”	chance legal hold or active peer review investigation.	High risk. Seek a second opinion at a different facility.

The Reliability Gap: Directories vs. Direct Verification

The between public directories and internal hospital data is dangerous. While insurers update their lists periodically (frequently exceeding the 90-day federal mandate), hospital MSSDs update privilege status in real-time. If a surgeon is suspended on Tuesday morning for a safety violation, the MSSD knows by Tuesday afternoon. The insurance directory may not reflect this change for months.

The Taxonomy of Sanctions: Decoding Board Terminology

The transition from federal identification to state-level verification requires a shift in investigative mindset. While the NPPES registry confirms a provider exists, state medical board (SMB) records confirm they are safe to practice. The primary challenge for an investigator is not finding the record interpreting the bureaucratic euphemisms used to describe misconduct. State boards use a standardized yet frequently unclear lexicon to categorize actions. You must distinguish between a procedural error and a patient safety threat.

Medical board actions fall into two distinct buckets: administrative and disciplinary. Administrative actions are generally non-prejudicial. They reflect a failure to navigate paperwork or bureaucracy. Disciplinary actions are prejudicial. They reflect a failure in competence, ethics, or safety. The Federation of State Medical Boards (FSMB) reported 6, 601 total actions in 2024. Only a fraction of these represented true threats to public safety. Yet the distinction is frequently buried in the fine print of a PDF order.

Administrative Lapses: The “Parking Tickets” of Medicine

Administrative lapses appear frequently in board databases. They frequently trigger a “flagged” status that looks worrying to the untrained eye. These actions involve expired licenses, unpaid renewal fees, or failure to complete Continuing Medical Education (CME) credits. Between 2020 and 2022, states issued waivers for administrative requirements due to the COVID-19 pandemic. As these waivers expired in 2023 and 2024, boards initiated a “cleanup” phase. This resulted in a spike of administrative flags that do not correlate with malpractice.

A doctor with a license status of “Active, Probation” due to a missed CME deadline presents a fundamentally different risk profile than one on probation for opioid overprescribing. You must read the underlying “Findings of Fact” document. If the order cites “statutory non-compliance” regarding fees or hours, it is an administrative lapse. If it cites “unprofessional conduct” or “negligence,” it is a red flag.

The Danger Signals: Prejudicial and Disciplinary Actions

Disciplinary actions signal that a physician has violated the Medical Practice Act of their state. These are the metrics that matter for patient safety. In 2024, state boards disciplined 3, 023 physicians. Of these, 1, 507 were -time offenders. The severity of these actions varies, specific terms serve as universal indicators of danger.

Sanction Term	Severity Level	Investigative Implication
Revocation	serious	The “nuclear option.” The board has permanently removed the right to practice. This is reserved for egregious offenses like sexual misconduct, gross negligence, or felony convictions.
Summary / Emergency Suspension	serious	Immediate cessation of practice before a hearing. This indicates an imminent threat to the public. Common in cases of active substance abuse or predatory behavior.
Voluntary Surrender	High	frequently a plea bargain. The physician gives up their license to avoid a public hearing or further prosecution. This is a major red flag frequently misread as “retirement.”
Probation	High/Medium	The doctor practices under restrictions. Look for terms like “chaperone required” (sexual misconduct) or “drug testing” (substance abuse).
Letter of Reprimand	Medium/Low	A public slap on the wrist. It acknowledges wrongdoing allows unrestricted practice. frequently the result of a negotiated settlement.

The “Voluntary Surrender” Loophole

The most deceptive term in medical regulation is “Voluntary Surrender.” To a layperson, this sounds like a dignified retirement. In the context of a medical investigation, it is frequently a confession of guilt. Physicians facing revocation hearings frequently negotiate a surrender to seal the investigative file. This stops the public airing of evidence. If a doctor “surrenders” their license while under investigation, treat it as a revocation. The FSMB and the National Practitioner Data Bank (NPDB) code these as serious disciplinary actions. Yet the public-facing state website may simply list the status as “Surrendered” without the “while under investigation” qualifier. You must request the original consent order to verify the context.

Investigative Rule: If a physician under the age of 60 surrenders a license in one state while maintaining active licenses in others, assume they are fleeing a disciplinary event. Cross-reference the surrender date with the “Date of Action” in other jurisdictions.

The Gray Zone: Consent Orders and Plea Bargains

Most medical board cases never reach a formal hearing. They are resolved through “Consent Orders” or “Agreed Orders.” These are legal settlements where the physician admits to certain facts in exchange for a lighter penalty. A doctor accused of gross negligence resulting in patient death might sign a Consent Order admitting only to “failure to maintain adequate records.” The penalty might be a fine and a remedial record-keeping course.

This bureaucratic sleight of hand disguises the severity of the incident. When analyzing a Consent Order, ignore the admitted violation. Focus on the Findings of Fact section. This narrative portion frequently contains the details of the actual event. A “record-keeping” violation that involves a patient death is not a paperwork error. It is a malpractice proxy. In 2024, the Texas Medical Board frequently used “Remedial Plans” for minor violations. These are public technically non-disciplinary. Yet they frequently cover problem like “failure to diagnose” which would be considered malpractice in a civil court.

State Variability: The Zip Code Lottery

A “clean” license in one state does not equal a “clean” license in another. State medical boards vary wildly in their enforcement aggression. Public Citizen’s Health Research Group publishes a triennial ranking of state boards based on the rate of serious disciplinary actions (revocations, suspensions, surrenders) per 1, 000 physicians.

Data from the 2021-2023 period (published October 2024) reveals a. The Ohio State Medical Board took serious disciplinary action at a rate of 1. 82 per 1, 000 physicians. In contrast, the Medical Licensing Board of Indiana took action at a rate of only 0. 17 per 1, 000. This is a tenfold difference. A doctor in Indiana is statistically ten times less likely to be disciplined for the same behavior as a doctor in Ohio.

When investigating a doctor with a multi-state history, weigh their record against the enforcement rigor of the licensing state. A single “Reprimand” in a lenient state like Indiana or Georgia may indicate behavior that would have resulted in “Probation” or “Suspension” in a strict state like Ohio, Michigan, or Arizona. Conversely, a “clean” record in the District of Columbia (ranked lowest in several past reports) offers little assurance of safety.

Analyzing the 2024-2026 Trends

The post-pandemic regulatory environment has shifted. In 2025, boards began aggressively targeting misinformation and telemedicine fraud. The FSMB Census 2024 noted a 43% increase in new licenses issued since 2020. This surge was driven by telehealth expansion. Consequently, investigators are seeing a rise in “reciprocal discipline.” This occurs when a doctor is disciplined in State A (e. g., for overprescribing via video call) and State B automatically problem a matching sanction.

You must verify if a disciplinary action is original or derivative. A “reciprocal action” cite the “sister state’s order” as the basis. Always trace the chain back to the originating state to find the source documents. The originating state holds the evidence. The reciprocal state holds only the paperwork.

Red Flag Checklist for 2026

When reviewing a physician’s profile, apply this immediate filter to separate noise from signal:

1. Status Check: Is the license “Active” without conditions? Any modifier (Probation, Conditioned, Limited) is a red flag.
2. History Check: Are there any past actions? Even resolved actions (“Probation Terminated”) indicate a history of recidivism risk.
3. Jurisdiction Check: Did the doctor move from a high-enforcement state to a low-enforcement state immediately following a “voluntary surrender”?
4. Document Check: Does the “Consent Order” describe patient harm in the narrative, even if the legal charge is administrative?

By rigorously filtering these data points, you move beyond the binary of “licensed vs. unlicensed.” You enter the of risk assessment. A license is a snapshot of current legal standing. It is not a guarantee of future competence.

The Evidence Dossier: Pre-Escalation Requirements

Reporting a physician for fraudulent credentials is a legal trigger, not a customer service complaint. State medical boards and federal agencies operate under strict evidentiary standards. A vague tip regarding a “suspicious doctor” be dismissed. Before accessing any whistleblower portal, you must compile a digital evidence package that establishes probable cause. This dossier prevents your report from dying in the intake queue.

Your evidence package must include three specific components:

1. The Primary gap: A side-by-side comparison of the physician’s claimed credentials (website bio, office signage) versus the primary source verification (PSV) output. If the doctor claims board certification in neurosurgery, the ABMS database returns “Not Certified,” capture both screens with timestamps.
2. The NPI Snapshot: A PDF export of the NPPES registry entry. Highlight the “Enumeration Date” and “Taxonomy Code.” Fraudulent actors frequently select taxonomy codes that do not match their state licensure scope to bypass automated billing filters.
3. The Practice Evidence: Proof of active patient care. A revoked license is only a crime if the individual continues to practice. Secure appointment confirmation emails, photos of the lobby directory, or billing statements dated after the license expiration or revocation date.

Investigative Rule: Do not rely on live URLs. Fraudulent actors scrub websites minutes after receiving an inquiry. Use the Wayback Machine or archive. is to permanently cache the target’s claims before you file a report.

State-Level Reporting method

The state medical board is the primary jurisdiction for licensure fraud. yet, the intake funnel is steep. Data from the Medical Board of California (MBC) for the 2023-2024 fiscal year reveals the attrition rate: out of 9, 521 complaints received, only 1, 080 went to investigation, and a mere 17 resulted in criminal referrals. To survive this filter, you must select the correct reporting channel. Most states distinguish between “Standard of Care” complaints (bad outcomes) and “Unlicensed Activity/Fraud” (criminal acts).

In Florida, for example, the Department of Health operates a dedicated Unlicensed Activity (ULA) Unit. In the 2023-2024 period, this unit received 1, 489 complaints. Unlike standard board complaints which frequently take years, the ULA unit issued 505 Cease and Desist orders and made 528 referrals to law enforcement. This indicates a 35% immediate action rate for fraud-specific reports, significantly higher than the general disciplinary average.

Direct Reporting Channels for Major Jurisdictions

State	Target Agency	Specific Fraud Portal	2024-2025 Action Metric
California	Medical Board of California (MBC)	Health Quality Investigation Unit (HQIU)	17 Criminal Referrals (High Bar)
Texas	Texas Medical Board (TMB)	Investigations Department (Place of Service Verification)	140 Pending>1 Year (Backlog Warning)
Florida	Dept. of Health (MQA)	Unlicensed Activity (ULA) Unit	505 Cease & Desist Orders Issued
New York	Office of Professional Medical Conduct (OPMC)	Bureau of Investigations	Strict Confidentiality (No Public Tracking)

Federal Escalation: The OIG and DOJ Pipeline

If the fraudulent physician accepts Medicare, Medicaid, or TRICARE, the offense crosses from state regulatory violation to federal felony. The U. S. Department of Health and Human Services Office of Inspector General (HHS-OIG) handles these cases. Federal intervention is necessary when the fraud involves multi-state billing or organized credential fabrication.

The of federal enforcement has expanded drastically. On July 1, 2025, the Department of Justice announced its largest-ever coordinated healthcare fraud takedown, charging 324 defendants, including 96 doctors and licensed professionals, with schemes involving $14. 6 billion in intended losses. This represents a massive escalation from the 2024 action, which involved $2. 75 billion. The data shows that federal prosecutors are prioritizing high-dollar billing fraud linked to credential abuse.

When reporting to the OIG Hotline (1-800-HHS-TIPS), you must explicitly frame the complaint as “Billing Fraud via Fraudulent Credentials.” The OIG does not investigate bad medicine; they investigate stolen taxpayer money. Your narrative must demonstrate that every dollar billed by the unlicensed or falsely credentialed provider constitutes a False Claim.

Case Study: The “Operation Nightingale” Precedent

The urgency of verifying educational history is underscored by “Operation Nightingale,” a multi-year federal enforcement action that is still yielding convictions in 2026. Initially focused on nursing, this operation exposed a massive diploma mill ecosystem in Florida that sold over 7, 600 fake degrees. As of late 2025, Phase II of the operation charged 12 additional defendants and triggered license revocations across Connecticut, Washington, and Texas.

For investigators, Nightingale confirms that possession of a diploma and a transcript does not prove competence. If you suspect a physician obtained their degree from a non-accredited Caribbean or defunct institution, cross-reference their graduation year with the school’s accreditation status in the FSMB Physician Data Center. If the dates do not align, report the gap to the FSMB immediately. In 2024, the FSMB issued 24, 325 disciplinary alerts to state boards, proving that data sharing is the most method for stopping roving imposters.

Whistleblower Financial Incentives (Qui Tam)

Under the False Claims Act, private citizens who report fraud against the government may be eligible for a portion of the recovered funds. This is known as a Qui Tam lawsuit. If a “doctor” without a valid license bills Medicare for $5 million over three years, and your evidence leads to a recovery, you could receive between 15% and 30% of the settlement.

yet, Qui Tam cases require a specific legal process. not file a standard hotline tip and claim a reward later. You must file a lawsuit under seal with the assistance of an attorney specializing in federal whistleblower litigation. The Department of Justice then investigates the claim while it remains secret. Given the OIG’s expectation to recover $7. 13 billion in FY 2024 alone, the financial for accurate reporting are substantial.

Visualizing the Enforcement Funnel

The following data grid illustrates the clear reality of enforcement. While complaints are high, the number of physicians actually removed from practice is a fraction of the total volume. This emphasizes the need for high-quality, verified evidence in your initial report.

2024-2025 DISCIPLINARY ATTRITION MATRIX (Select Jurisdictions)

METRIC	CALIFORNIA (MBC)	FLORIDA (ULA)	FEDERAL (DOJ/OIG)
Total Complaints	9, 521	1, 489	N/A (Tips)
Investigations Opened	1, 080	1, 380	1, 548 (Actions)
Criminal/Civil Charges	17	528	324
Financial Impact	Cost Recovery Only	Fines ($1k-$5k)	$14. 6 Billion

The “Golden Record” does not exist in a single database. It is a constructed asset. A physician’s digital footprint is fragmented across federal billing registries, state legal boards, and private certification bodies. To build a verified dossier, you must synthesize these signals into a unified profile. This process, known as data triangulation, exposes the gaps where fraud and negligence hide.

The Triangulation Protocol

A verified dossier relies on three pillars of authority: Federal (NPI), State (Licensure), and Specialty (Board Certification). Each source serves a distinct function, and their disagreement is frequently more valuable than their alignment.

1. The Federal Anchor (NPI/NPPES)
The National Provider Identifier is the billing key. As of July 2025, the NPPES registry reflects over 8 million records. yet, an “Active” NPI status indicates the provider can bill CMS; it does not prove they are legally permitted to practice medicine. In 2024, CMS revoked or suspended billing privileges for 205 providers, yet retained active NPIs for weeks post-action due to the 30-day reporting window allowed by regulation 45 CFR 162. 410(a)(4).

2. The Legal Authority (State Boards)
State boards possess the sole power to revoke a license. In 2024, state boards issued 6, 601 disciplinary actions against 3, 023 physicians. This represents a serious enforcement. A physician may hold a clear license in Texas while facing revocation in Ohio. The Federation of State Medical Boards (FSMB) Physician Data Center (PDC) acts as the here, having distributed 24, 325 disciplinary alerts in 2024 alone.

3. The Quality Seal (ABMS)
Board certification is voluntary indicates clinical currency. The American Board of Medical Specialties (ABMS) reported 1, 025, 104 active diplomates as of June 30, 2025. A lapse here frequently signals a withdrawal from clinical practice or a failure to meet Maintenance of Certification (MOC) standards.

The gap Matrix

When synthesizing data, you must align these three sources. Discrepancies constitute “Red Flags” that demand immediate investigation. Use the following matrix to categorize findings:

Signal Type	NPI Status	State License	Board Cert	Investigative Conclusion
Green	Active	Active / Good Standing	Certified	Verified Profile. No immediate indicators of risk.
Yellow	Active	Active / Probation	Certified	Operational Risk. Provider is practicing under restrictions. Request full board order.
Red	Active	Revoked / Suspended	Revoked / Expired	Fraud Risk. Provider may be billing illegally. See Dr. Sophie Toya case (2025).
Grey	Deactivated	Active	Certified	Administrative Lag. Provider may have retired or moved. Verify practice location.

Case Study: The Cost of Fragmented Verification

The 2025 sentencing of Dr. Sophie Toya in Michigan illustrates the danger of relying on a single data point. Toya maintained an active NPI and billed Medicare for $6. 3 million in unnecessary orthotic braces. While her federal billing ID remained active, indicators of fraud, such as prescribing 136 braces in a single day, were visible in claims data long before the indictment. Similarly, the 2025 conviction of Paul Njoku in Texas for falsifying records involved a home health agency that retained billing privileges even with severe compliance failures. These cases demonstrate that an “Active” status in the NPI registry is not a character reference. It is a billing switch. You must validate that switch against the state’s permission to operate.

Constructing the Final Dossier

A professional physician dossier must follow a strict schema. Do not use narrative paragraphs; use structured data fields. This format allows for rapid scanning by legal and compliance teams.

1. Identity Verification

• Full Legal Name: Must match government ID and NPI record exactly.
• NPI: 10-digit identifier (Check against NPPES).
• DOB / Grad Year: Used to distinguish common names. (FSMB Census 2024: Average physician age is 51. 8).
• Aliases: Maiden names or variations found in the “Other Name” NPI field.

2. Licensure History (Multi-State)

List every state where the physician holds or held a license. Fraudsters frequently move to new jurisdictions to escape discipline.

State	License #	Status	problem Date	Exp. Date	Disciplinary Action?
TX	M1234	Active	2010-05-12	2026-11-30	NO
OH	35. 098	Inactive	2008-01-15	2012-01-15	YES (Consent Order)

3. Board Certification Status

Verify directly via ABMS Solutions or the specific specialty board (e. g., ABIM). Note the “Participating in MOC” status. A physician certified in 1990 who has not maintained certification may still claim “Board Certified” in marketing materials, which is a verifyable falsehood.

4. Adverse Action Summary

Compile a chronological list of all sanctions. This includes:

• State Board Orders: Suspensions, probations, fines.
• Federal Exclusions: OIG LEIE (List of Excluded Individuals/Entities) status.
• Hospital Privileges: Revocations reported to the NPDB (National Practitioner Data Bank). Note: NPDB public files are anonymized; use them for statistical context or access via authorized querying entities.

The FSMB Factor: Centralized Verification

For high-volume investigations, manual state-by-state verification is inefficient. The Federation of State Medical Boards (FSMB) offers the most accurate aggregate data. Their 2024 census reports a 27% increase in the licensed physician population since 2010, totaling 1, 082, 187 doctors. The FSMB’s DocInfo. org provides a public-facing version of this data. It aggregates actions from 70 state and territorial medical boards. While DocInfo is authoritative, it updates at varying intervals depending on the reporting state, daily, monthly. For a bulletproof dossier, always click through to the primary source (the specific state board website) to view the actual PDF of the disciplinary order.

Final Verification Checklist

Before publishing a report or clearing a candidate, execute this final “Go/No-Go” protocol.

1. The Name Match: Does the name on the medical license match the name on the board certification exactly? Middle initials matter.
2. The Temporal Check: Are there unexplained gaps in the practice history? A three-year gap frequently hides a suspension or incarceration.
3. The Cross-Border Check: Did you check neighboring states? A doctor revoked in New Jersey may be practicing in Pennsylvania.
4. The DEA Check: Does the physician have a valid DEA registration for prescribing controlled substances? (Verify via NTIS if accessible, or infer through state controlled substance registrations).
5. The OIG Check: Is the provider on the OIG Exclusion List? If yes, they cannot receive federal funds, rendering them unemployable by most hospitals.

Data Integrity Warning

In 2025, the Department of Justice charged 324 defendants in a $14. 6 billion health care fraud takedown. of these schemes relied on the “fragmentation gap”—the time between a crime being committed and the data appearing in a registry. Your dossier is a snapshot in time. Always timestamp your verification. A “Clean” status today does not guarantee a “Clean” status tomorrow. Continuous monitoring is the only defense against the lag in bureaucratic reporting.